fix: replace standalone dependency-audit.yml with org standard thin caller stub

.github/workflows/dependency-audit.yml

@@ -1,14 +1,22 @@
-# Dependency vulnerability audit.
-# Detects ecosystems and runs appropriate audit tools (npm, pnpm, Go, Rust, Python).
-# Standard: https://github.com/petry-projects/.github/blob/main/standards/dependabot-policy.md#vulnerability-audit-ci-check
+# ─────────────────────────────────────────────────────────────────────────────
+# SOURCE OF TRUTH: petry-projects/.github/standards/workflows/dependency-audit.yml
+# Standard:        petry-projects/.github/standards/ci-standards.md#7-dependency-audit-dependency-audityml
+# Reusable:        petry-projects/.github/.github/workflows/dependency-audit-reusable.yml
 #
-# Auto-detects ecosystems present in the repository and runs the appropriate
-# audit tool. Fails the build if any dependency has a known security advisory.
+# AGENTS — READ BEFORE EDITING:
+#   • This file is a THIN CALLER STUB. All ecosystem-detection and audit logic
+#     lives in the reusable workflow above.
+#   • You MAY change: nothing in this file in normal use. Adopt verbatim.
+#   • You MUST NOT change: trigger events, the `uses:` line, or job name
+#     (used as a required status check).
+#   • If you need different behaviour (new ecosystem, tool version bump),
+#     open a PR against the reusable in the central repo.
+# ─────────────────────────────────────────────────────────────────────────────
 #
-# Add "dependency-audit" as a required status check in branch protection.
-#
-# Pinned tool versions (update deliberately):
-#   govulncheck v1.1.4 | cargo-audit 0.22.1 | pip-audit 2.9.0
+# Dependency vulnerability audit — thin caller for the org-level reusable.
+# To adopt: copy this file to .github/workflows/dependency-audit.yml in your repo.
+# Add "dependency-audit / Detect ecosystems" as a required status check
+# in branch protection.
 name: Dependency audit
 
 on:
@@ -21,198 +29,5 @@ permissions:
   contents: read
 
 jobs:
-  detect:
-    name: Detect ecosystems
-    runs-on: ubuntu-latest
-    outputs:
-      npm: ${{ steps.check.outputs.npm }}
-      pnpm: ${{ steps.check.outputs.pnpm }}
-      gomod: ${{ steps.check.outputs.gomod }}
-      cargo: ${{ steps.check.outputs.cargo }}
-      pip: ${{ steps.check.outputs.pip }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
-
-      - name: Detect package ecosystems
-        id: check
-        run: |
-          # npm — look for package-lock.json anywhere (excluding node_modules)
-          if find . -name 'package-lock.json' -not -path '*/node_modules/*' | grep -q .; then
-            echo "npm=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "npm=false" >> "$GITHUB_OUTPUT"
-          fi
-
-          # pnpm — look for pnpm-lock.yaml anywhere
-          if find . -name 'pnpm-lock.yaml' -not -path '*/node_modules/*' | grep -q .; then
-            echo "pnpm=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "pnpm=false" >> "$GITHUB_OUTPUT"
-          fi
-
-          # Go modules — detect via go.mod (not go.sum, which may not exist)
-          if find . -name 'go.mod' -not -path '*/vendor/*' | grep -q .; then
-            echo "gomod=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "gomod=false" >> "$GITHUB_OUTPUT"
-          fi
-
-          # Cargo — detect via Cargo.toml anywhere (lockfile may not exist for libraries)
-          if find . -name 'Cargo.toml' -not -path '*/target/*' | grep -q .; then
-            echo "cargo=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "cargo=false" >> "$GITHUB_OUTPUT"
-          fi
-
-          # Python — detect pyproject.toml or requirements.txt anywhere
-          if find . -name 'pyproject.toml' -not -path '*/.venv/*' -not -path '*/venv/*' | grep -q . || \
-             find . -name 'requirements.txt' -not -path '*/.venv/*' -not -path '*/venv/*' | grep -q .; then
-            echo "pip=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "pip=false" >> "$GITHUB_OUTPUT"
-          fi
-
-  audit-npm:
-    name: npm audit
-    needs: detect
-    if: needs.detect.outputs.npm == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "lts/*"
-
-      - name: Audit npm dependencies
-        run: |
-          # Audit each package-lock.json found in the repo
-          status=0
-          while IFS= read -r dir; do
-            echo "::group::npm audit $dir"
-            if ! (cd "$dir" && npm audit --audit-level=low); then
-              status=1
-            fi
-            echo "::endgroup::"
-          done < <(find . -name 'package-lock.json' -not -path '*/node_modules/*' -exec dirname {} \;)
-          exit $status
-
-  audit-pnpm:
-    name: pnpm audit
-    needs: detect
-    if: needs.detect.outputs.pnpm == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
-
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v4
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "lts/*"
-
-      - name: Audit pnpm dependencies
-        run: |
-          # Audit each pnpm-lock.yaml found in the repo
-          status=0
-          while IFS= read -r dir; do
-            echo "::group::pnpm audit $dir"
-            if ! (cd "$dir" && pnpm audit --audit-level low); then
-              status=1
-            fi
-            echo "::endgroup::"
-          done < <(find . -name 'pnpm-lock.yaml' -not -path '*/node_modules/*' -exec dirname {} \;)
-          exit $status
-
-  audit-go:
-    name: govulncheck
-    needs: detect
-    if: needs.detect.outputs.gomod == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
-
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v5
-        with:
-          go-version: "stable"
-
-      - name: Install govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
-
-      - name: Audit Go dependencies
-        run: |
-          status=0
-          while IFS= read -r dir; do
-            echo "::group::govulncheck $dir"
-            if ! (cd "$dir" && govulncheck ./...); then
-              status=1
-            fi
-            echo "::endgroup::"
-          done < <(find . -name 'go.mod' -not -path '*/vendor/*' -exec dirname {} \;)
-          exit $status
-
-  audit-cargo:
-    name: cargo audit
-    needs: detect
-    if: needs.detect.outputs.cargo == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
-
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-
-      - name: Install cargo-audit
-        run: cargo install cargo-audit@0.22.1 --locked
-
-      - name: Audit Cargo dependencies
-        run: |
-          # cargo audit operates on Cargo.lock at workspace root
-          # For workspaces, a single audit at root covers all crates
-          status=0
-          while IFS= read -r dir; do
-            echo "::group::cargo audit $dir"
-            if ! (cd "$dir" && cargo generate-lockfile 2>/dev/null; cargo audit); then
-              status=1
-            fi
-            echo "::endgroup::"
-          done < <(find . -name 'Cargo.toml' -not -path '*/target/*' -exec dirname {} \; | sort -u)
-          exit $status
-
-  audit-pip:
-    name: pip-audit
-    needs: detect
-    if: needs.detect.outputs.pip == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
-
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.x"
-
-      - name: Install pip-audit
-        run: pip install pip-audit==2.9.0
-
-      - name: Audit Python dependencies
-        run: |
-          status=0
-          # Audit each Python project found in the repo
-          while IFS= read -r dir; do
-            echo "::group::pip-audit $dir"
-            if [ -f "$dir/pyproject.toml" ]; then
-              if ! pip-audit "$dir"; then
-                status=1
-              fi
-            elif [ -f "$dir/requirements.txt" ]; then
-              if ! pip-audit -r "$dir/requirements.txt"; then
-                status=1
-              fi
-            fi
-            echo "::endgroup::"
-          done < <(
-            {
-              find . -name 'pyproject.toml' -not -path '*/.venv/*' -not -path '*/venv/*' -exec dirname {} \;
-              find . -name 'requirements.txt' -not -path '*/.venv/*' -not -path '*/venv/*' -exec dirname {} \;
-            } | sort -u
-          )
-          exit $status
+  dependency-audit:
+    uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@d3d768dabb7f28cc63283cdfe48630da53700e50 # v1

scripts/compliance-audit.sh

@@ -1752,6 +1752,29 @@ ensure_required_labels() {
   done
 }
 
+# Create all required labels (idempotent — uses --force to update if present)
+ensure_required_labels() {
+  local repo="$1"
+  # Format: "name|color|description" (pipe-delimited to avoid colon conflicts)
+  local label_configs=(
+    "security|d93f0b|Security-related PRs and issues"
+    "dependencies|0075ca|Dependency update PRs"
+    "scorecard|d93f0b|OpenSSF Scorecard findings"
+    "bug|d73a4a|Bug reports"
+    "enhancement|a2eeef|Feature requests"
+    "documentation|0075ca|Documentation changes"
+  )
+
+  for config in "${label_configs[@]}"; do
+    IFS='|' read -r name color description <<< "$config"
+    gh label create "$name" \
+      --repo "$ORG/$repo" \
+      --description "$description" \
+      --color "$color" \
+      --force 2>/dev/null || true
+  done
+}
+
 create_issue_for_finding() {
   local repo="$1" category="$2" check="$3" severity="$4" detail="$5" standard_ref="$6"
 

standards/ci-standards.md

@@ -238,6 +238,11 @@ In addition, BMAD Method-enabled repositories MUST also include the conditional
 documented below — see [`standards/workflows/feature-ideation.yml`](workflows/feature-ideation.yml)
 for the template.
 
+In addition, BMAD Method-enabled repositories MUST also include the conditional
+[Feature Ideation workflow](#9-feature-ideation-feature-ideationyml--bmad-method-repos)
+documented below — see [`standards/workflows/feature-ideation.yml`](workflows/feature-ideation.yml)
+for the template.
+
 ### 1. CI Pipeline (`ci.yml`)
 
 The primary build-and-test workflow. Structure varies by tech stack but must include:

standards/workflows/dependency-audit.yml

@@ -1,6 +1,6 @@
 # ─────────────────────────────────────────────────────────────────────────────
 # SOURCE OF TRUTH: petry-projects/.github/standards/workflows/dependency-audit.yml
-# Standard:        petry-projects/.github/standards/ci-standards.md#5-dependency-audit-dependency-auditym
+# Standard:        petry-projects/.github/standards/ci-standards.md#7-dependency-audit-dependency-audityml
 # Reusable:        petry-projects/.github/.github/workflows/dependency-audit-reusable.yml
 #
 # AGENTS — READ BEFORE EDITING: