💡 Automated Compliance Self-Healing Pipeline

[github-actions[bot]]

Summary

Extend compliance-audit.sh to automatically generate fix PRs for well-understood, recurring compliance findings instead of only filing issues. Target the top remediation patterns (unpinned actions, missing standard labels, missing required workflows) that account for the majority of compliance churn. Human review is preserved via PR approval requirements.

Market Signal

GitHub's 2026 Actions security roadmap introduces policy-driven execution protections with evaluate mode, signaling a platform shift from detect-and-report to detect-and-enforce. Compliance-as-code platforms (Pull Checklist, ComplianceAsCode) are converging on auto-remediation as the standard pattern. GitHub's own roadmap emphasizes "fewer per-workflow configurations, more centralized, enforceable policy." The industry trend is clear: compliance findings should be fixed, not just reported.

User Signal

Issue #35 explicitly requests automated compliance remediation. The signals show 35 closed compliance-audit issues in 30 days and 10+ open compliance issues currently. The compliance audit creates umbrella issues, agents claim and fix them via the claim-before-work protocol, but the coordination overhead is significant. Recurring patterns like unpinned actions (issues #104, #105, #106, #239) and missing settings (issues #108, #109, #240) are well-understood with deterministic fixes.

Technical Opportunity

compliance-audit.sh already detects findings and categorizes them. The remediation patterns for:

• Unpinned actions → look up SHA via GitHub API, update workflow YAML (already done manually in many PRs)
• Missing labels → call apply-repo-settings.sh (script already exists)
• Missing workflows → call deploy-standard-workflows.sh (script already exists)

Self-healing connects the detection output to the existing remediation scripts, creating one PR per remediation category per affected repo. No new remediation logic needs to be invented.

Assessment

Dimension	Score	Rationale
Feasibility	high	Remediation scripts already exist; the work is connecting detection output to remediation input
Impact	high	Eliminates 35+ issues/month of toil; frees agent capacity for higher-value work
Urgency	high	Issue #35 is an explicit, long-standing request; compliance churn is the largest source of repetitive work

Adversarial Review

Strongest objection: Auto-generated PRs for compliance fixes could introduce errors or bypass review expectations. The current issue-then-fix loop, while slower, ensures human deliberation.

Rebuttal: The current loop creates 5-15 issues per audit run, each requiring claim protocol, branch creation, PR, review, and merge. 35 closed issues in 30 days proves the toil is unsustainable. Self-healing targets only deterministic patterns with known-good remediation scripts that are already tested. PR approval requirements (enforced by the pr-quality ruleset) ensure human review before any change reaches main. The proposal explicitly excludes ambiguous findings that require judgment.

Suggested Next Step

Categorize the last 60 days of compliance-audit findings by remediation type. Identify the top 3 categories with deterministic, scriptable fixes. Add a --auto-fix flag to compliance-audit.sh that, for those categories, runs the remediation script and opens a PR instead of filing an issue. Start with unpinned-actions as the safest category.