Issues

• AgentShield reusable: min-severity input does not set the failure threshold

  bugcipriority:minor
  combsmith/.github#1436 · Filter by author don-petry opened on Oct 30, 2026

• Org Status — 2026-10-30

  daily-report
  combsmith/.github#1434 · Filter by author don-petry opened on Oct 30, 2026

• [Fleet Monitor] combsmith/.github — .github/workflows/codeql-audit.yml

  dev-leadfleet-trackerhealth-check
  combsmith/.github#1433 · Filter by author don-petry opened on Oct 30, 2026

• dependency-audit-reusable: the required check is ecosystem discovery, not the scanners' outcome

  in-progresssecurity
  combsmith/.github#1406 · Filter by author don-petry opened on Oct 28, 2026

• agent-shield-reusable runs the scanner via npm inside the PR checkout, so a PR's .npmrc can neuter the scan

  in-progresssecurity
  combsmith/.github#1405 · Filter by author don-petry opened on Oct 28, 2026

• canary-rollout.sh rollback force-moves any destination tag, including immutable release tags, without checking it is a channel

  in-progresssecurity
  combsmith/.github#1402 · Filter by author don-petry opened on Oct 28, 2026

• dependabot-automerge-reusable approves the whole PR from first-commit Dependabot metadata, including later non-Dependabot commits

  in-progresssecurity
  combsmith/.github#1400 · Filter by author don-petry opened on Oct 28, 2026

• dependabot-rebase-reusable merges with the bypass App after checks complete without requiring successful conclusions

  in-progresssecurity
  combsmith/.github#1399 · Filter by author don-petry opened on Oct 28, 2026

• auto-rebase-reusable: PR base branch name is pasted unescaped into the published recovery shell command

  in-progresssecurity
  combsmith/.github#1396 · Filter by author don-petry opened on Oct 28, 2026

• sonarcloud.yml runs the PR's Python test code with the SonarCloud token in the job environment

  in-progresssecurity
  combsmith/.github#1392 · Filter by author don-petry opened on Oct 28, 2026

• dev-lead-retrigger.sh trusts the dev-lead/ branch prefix as proof of agent activity; fork PRs can suppress compliance retriggers

  in-progresssecurity
  combsmith/.github#1391 · Filter by author don-petry opened on Oct 28, 2026

• standards sonarcloud.yml passes the required check when SONAR_TOKEN is unavailable, so fork PRs skip analysis permanently

  in-progresssecurity
  combsmith/.github#1390 · Filter by author don-petry opened on Oct 28, 2026

• feature-ideation: model with Discussion-write token can bypass dry_run and the target-Discussion guard via its Bash tool

  in-progresssecurity
  combsmith/.github#1389 · Filter by author don-petry opened on Oct 28, 2026

• classify-initiative.sh echoes untrusted issue/PR titles raw to runner stdout, so a title can inject workflow commands

  in-progresssecurity
  combsmith/.github#1384 · Filter by author don-petry opened on Oct 28, 2026

• Scorecard: Vulnerabilities (7/10)

  scorecard
  combsmith/.github#1380 · Filter by author don-petry opened on Oct 26, 2026

• SonarCloud: code security review (pythonsecurity)

  dev-leadpriority:majorsecuritysonarcloud-audit
  combsmith/.github#1361 · Filter by author don-petry opened on Oct 20, 2026
  3

• Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor

  combsmith/.github#1352 · Filter by author don-petry opened on Oct 19, 2026

• Compliance audit — 2026-10-16

  compliance-auditdev-lead
  combsmith/.github#1343 · Filter by author don-petry opened on Oct 16, 2026
  12

• dev-lead: deferred review findings

  combsmith/.github#1335 · Filter by author don-petry opened on Oct 14, 2026
  4

• Standards channel standards/v1-stable is behind main — promote it

  combsmith/.github#1328 · Filter by author github-actions opened on Oct 12, 2026

• Fix initiative-driver cooldown and daily budget to count actual dispatches

  combsmith/.github#1327 · Filter by author coderabbitai opened on Oct 12, 2026
  

• initiative-driver template omits issue labels from the rate-limit gate

  combsmith/.github#1326 · Filter by author coderabbitai opened on Oct 12, 2026
  

• Restore initial PR review triggering in the standard pr-review caller

  combsmith/.github#1325 · Filter by author coderabbitai opened on Oct 12, 2026
  

• canary-rollout: with two candidates in flight, no command can advance an upper ring pair past a BLOCKED gate, and an API-outage failure is a permanent REGRESSION

  bug
  combsmith/.github#1324 · Filter by author don-petry opened on Oct 12, 2026

• feature-ideation template: the Discussion bridge stays green when the dispatched ideate run fails (move the fix out of the .github-private stub)

  bug
  combsmith/.github#1322 · Filter by author don-petry opened on Oct 11, 2026