[catzo-agent]

The repo has no .github/workflows/security.yml, which fails the Art verify rule github:missing_security_workflow. This PR adds that file, calling the shared Articulate security workflow so CodeQL, dependency review and the Claude security review now run on PRs and pushes to main. I could not run art verify in this environment, so there is no real after-fix verify output yet.

Changes

• Added .github/workflows/security.yml, copied from the template in the rule's documentation. It calls articulate/security/.github/workflows/security.yml@v3 with secrets: inherit and leaves all inputs at their defaults.
• Left the existing build, lint and auto-merge workflows and the Dockerfiles alone. No service.json, verify.ignore overrides or .npmrc were added. The repo has no Node project, so the .npmrc scanner bug doesn't apply here.

Verify evidence:

• Before (output you observed on a fresh snapshot of 7786322): FAIL - Combined - github - Missing required security workflow file .github/workflows/security.yml. and 3 tests, 2 passed, 0 warnings, 1 failure, 0 exceptions.

• After: not available. Neither the art CLI nor an Art MCP verify tool is installed here, and neither are opa or conftest.

• What I checked instead: I applied the logic of the current policy/github.rego rules by hand to the files in the repo:

  • missing_security_workflow: fails on origin/main (3 workflows, none named security), passes on this branch (4 workflows, one is security.yml).
  • incorrect_security_workflow: passes, because the file references @v3.
  • node_lockfile_bypass: passes, because no workflow runs npm, yarn or pnpm install.

  This is a hand check, not an art verify record. Please run art verify on this branch before marking the PR ready.

Limits and notes:

• No other checks ran: the repo has no test suite, and actionlint and hadolint are not installed here. The Lint workflow in CI runs hadolint on the Dockerfiles only.
• No PR opened by me: there were no open PRs in the repo before this change. Per this environment's rules I committed to the agent branch but did not push or open the PR; the platform publishes the PR from that commit, and whether it opens as a draft depends on that publisher.
• Branch protection: the new Security checks start reporting on PRs, so a required-checks rule may need updating to include them.
• Metadata: written by Claude Code, model Claude Opus 5.5 (anthropic/claude-opus-5-5).

{
  "repo": "articulate/docker-ruby",
  "pr_url": null,
  "head_sha": "fdc6bd0e50ed0e555ff76c36f80b966ca664e04c",
  "base_sha": "7786322ff0959876210fce96a722e4ecbcb61862",
  "fixes": [{"rule_id": "github:missing_security_workflow", "change": "added .github/workflows/security.yml calling articulate/security/.github/workflows/security.yml@v3"}],
  "overrides": [],
  "before_verify": "1 failure (github:missing_security_workflow), 0 warnings, 2 passed (observed snapshot output)",
  "after_verify": "not run: art CLI/MCP unavailable; manual evaluation of github.rego rules shows 0 failures, 0 warnings",
  "tests": ["manual github.rego rule evaluation before/after"],
  "unresolved": ["Run art verify on this branch to get a real passing record", "PR URL is assigned when the platform publishes the branch"]
}

🤖 Generated with Claude Code

---

Agent session: 📊 Datadog · this job
Model: anthropic/claude-opus-5-5

[ivorisoutdoors]

This is a public repo and can't run that workflow