#1470 fix(security): require dependency-audit / Audit gate instead of Detect ecosystems (#1406)

Fixes #1406

What

The code-quality ruleset required dependency-audit / Detect ecosystems. That job passes once discovery finishes, whatever the scanners find, so a vulnerable dependency never blocked a merge. #1420 added the aggregate Audit gate job to the reusable. This PR makes it the required check:

-          {"context": "dependency-audit / Detect ecosystems"}
+          {"context": "dependency-audit / Audit gate", "integration_id": 15368}

integration_id 15368 is the GitHub Actions app, the same binding the repo uses for declared checks (mutation (all)). A commit status from any other app or token cannot satisfy the gate.

Also updated: the standards docs (github-settings.md, ci-standards.md, dependabot-policy.md), the caller-stub comments (self-host and standards/workflows/ template; the stub is pin-managed, so comment edits are not drift), the apply-rulesets.sh header, the compliance-audit stale-name remediation, and the tests that pin the required context (apply-rulesets.bats, required-checks/merge-group.bats). A new test asserts the binding. The reusable workflow itself is unchanged.

Verification

Context name. The check is published as dependency-audit / Audit gate by GitHub Actions (app 15368). Live check runs on consumer main confirm this, for example worldchest, incubator, markets and bmad-bgreat-suite. Every caller uses the job id dependency-audit, both this repo's local-ref stub and the fleet stubs.

Channel coverage. Every channel tag a consumer pins contains #1420 (a5de9a0):

Channel	Tag SHA	Has Audit gate	Pinned by
local ref	—	yes	combsmith/.github
dependency-audit/v2-stable	9bd9ea76	yes	broodly, google-app-scripts, worldchest, broodminder-data, ContentTwin, repo-template, incubator, markets, empower-personal-dashboard
dependency-audit/v2-ring1	08dd3572	yes	TalkTerm, bmad-bgreat-suite
dependency-audit/v2-next	08dd3572	yes	.github-private
dependency-audit/v2-ring0	08dd3572	yes	(none)
legacy stable / next / ring0 / ring1	04f28111 / efdfcf39	no	none of them; no consumer pins a legacy tag

software-factory and software-factory-canary have no dependency-audit caller and no code-quality ruleset, so they are unaffected.

Tests. The changed bats files pass locally (96 tests): apply-rulesets, required-checks/merge-group, standards-templates/merge-group-required-checks, dependency-audit and compliance-audit/declared-required-checks. CI runs the full suite.

Rollout (manual, maintainer)

Merging changes only the codified desired state. The live rulesets are written from two places, and both must carry this change. Otherwise the weekly self-heal puts Detect ecosystems back.

1. Promote the apply-repo-settings channels. Every channel tag (v1-stable 9bd9ea7, and v1-ring0/v1-ring1/v1-next 08dd357) still carries dependency-audit / Detect ecosystems. The weekly self-heal in each repo with a caller runs apply-rulesets.sh from its pinned channel and does a full-replace PUT, so it reverts a manual apply. Repos with a self-heal caller:

   Repo	Self-heal pin
   combsmith/.github	local ref (picks this up on merge)
   TalkTerm, markets, bmad-bgreat-suite	apply-repo-settings/v1-ring1
   empower-personal-dashboard	apply-repo-settings/v1-stable

   Promote these through the normal ring process to a release that contains this commit.

2. Apply to the repos without a self-heal caller (broodly, google-app-scripts, worldchest, broodminder-data, ContentTwin, repo-template, incubator, .github-private) from main:

   GH_TOKEN=<admin> ./scripts/apply-rulesets.sh --all --dry-run
   GH_TOKEN=<admin> ./scripts/apply-rulesets.sh --all
   

   Running --all before step 1 is safe, but the four self-heal repos fall back to Detect ecosystems on their next weekly run until their channel is promoted.

Until both steps are done, the compliance audit reports ruleset-drift-code-quality (missing dependency-audit / Audit gate) on each repo that has not been updated.

[!WARNING]
Once applied, merges are blocked in three repos whose main currently fails the audit:

Repo	Failing audit on main
broodly	pnpm audit, govulncheck
TalkTerm	npm audit
google-app-scripts	npm audit

This is the gate working as intended, but every PR in those repos, including partial Dependabot fixes, will be blocked until all advisories on the branch are resolved. Fix those dependencies first, or apply per-repo once they are green.

🤖 Generated with Claude Code