From b8dfbe89e5262a3e03d7ca4646be24e42bb6ca1c Mon Sep 17 00:00:00 2001 From: Rakesh S Date: Wed, 9 Sep 2026 21:36:03 +0530 Subject: [PATCH] fix(audit): read ruleset required checks when legacy list is empty Repos like ansible/actions keep branch protection for reviews but define required status checks in rulesets only. The legacy protection API returns an empty checks array, which made weekly supply-chain audits false-positive "no required status checks configured". Fall back to rulesets when legacy checks are missing. --- .../skills/td-supply-chain-audit/scripts/collect.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.agents/skills/td-supply-chain-audit/scripts/collect.py b/.agents/skills/td-supply-chain-audit/scripts/collect.py index 6ab63a7..5a89969 100644 --- a/.agents/skills/td-supply-chain-audit/scripts/collect.py +++ b/.agents/skills/td-supply-chain-audit/scripts/collect.py @@ -1338,7 +1338,16 @@ def collect_branch_protection(repo: str) -> dict: endpoint = f"repos/{repo}/branches/main/protection" data = gh_api(endpoint) if data and isinstance(data, dict) and "message" not in data: - return _legacy_branch_protection_result(data) + result = _legacy_branch_protection_result(data) + # Legacy API often returns empty required_status_checks.checks when the + # repo moved checks to rulesets (e.g. ansible/actions). Merge rulesets + # so audits do not false-positive "no required status checks". + if not result["required_checks"]: + ruleset_checks = _collect_ruleset_required_checks(repo) + if ruleset_checks: + result["required_checks"] = ruleset_checks + result["source"] = "branch_protection+rulesets" + return result required_checks = _collect_ruleset_required_checks(repo) if not required_checks: