Repository navigation
Org audit tools: org_settings_audit, org_audit_driver, org_inventory - #2292
Merged
Merged
Conversation
Adds three read-only org-wide tools and their tool-hub route rows. - org_settings_audit.py: audits GitHub organization-level settings (not one repo). - org_audit_driver.py: drives the per-repo audits across an org and records one result file per repo. - org_inventory.py: dated TSV inventory of every repo in one or more orgs; reconciles added and removed repos against a previous run; marks repos without a fresh non-empty `<org>__<repo>.*` result as NOT CHECKED. Fails closed with exit 2 on any API, scope or unexpected error, an empty listing, a count that disagrees with the org totals, a malformed --previous, a non-https --api-url or an off-host Link; follows the Link header with a 1000-page cap and never sends the token to another host. Closes #2278 Closes #2280 Closes #2281 Tests: 50/50 size-budget-raise: .claude/skills/deep-code-review/references/tool-hub.md 17473→19414 org settings audit, org audit driver and org inventory route rows Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…derr in reasons Fix the stderr-reason assertion in the previous commit (its Tests: 21/21 count was wrong; the suite has 20 checks). The driver now calls review_checks.sh with --full --full-history, allows repo names such as .github (still rejects . and ..), and appends the last stderr line of a failing review_checks to the FAILED reason. Tests: 20/20 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…0700 out If ORG_AUDIT_TOKEN is set, the token reaches only the git clone and fetch children, as an http.extraHeader passed through GIT_CONFIG_COUNT/KEY_n/VALUE_n environment entries appended after any the parent already has (never in the URL, argv or .git/config). review_checks and its scanners run with ORG_AUDIT_TOKEN, GH_TOKEN and GITHUB_TOKEN removed and never see the header. The token is masked in FAILED reasons, and --out is created 0700. Verified on a real run of 13 private repositories: all scanned OK, and the token appears in no output file. Tests: 26/26 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Shorten the org audit script summaries and split their usage paragraphs so the generated index rows stay short. Raise the three index budget rows the regenerated indexes exceed, and reset the lookup-cost cap in test_skill_index_split to the measured lookup plus 100 bytes. Tests: 61/61 size-budget-raise: .claude/skills/INDEX.md 17629→18145 org audit tool rows in the entry index size-budget-raise: .claude/skills/agentic-delivery/INDEX-scripts.md 17639→17829 org_settings_audit row size-budget-raise: .claude/skills/deep-code-review/INDEX-scripts.md 8523→9207 org_audit_driver, org_inventory, org_leak_sweep rows Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds three scripts for auditing a whole GitHub org. Each is routed from tool-hub.md.
Tests: 50/50. The inventory test runs in-process and is bounded (about 0.2 s). These local gates pass: routing, privacy, size, and size-ratchet (one documented raise, for tool-hub.md).
🤖 Generated with Claude Code