[org-monitor] Daily Report — 2026-03-15

[github-actions[bot]]

Monitored: 76 repositories | Excluded: php-swagger

⚠️ CRITICAL SECURITY ESCALATION: zircote/subcog has an exposed AWS Access Key in src/security/mod.rs (commit ad6f61a) reported 28+ hours ago with zero response. Immediate action required — see Attention Required section.

---

Organization Totals

Metric	Count
PRs opened	1
PRs merged	0
PRs closed (no merge)	0
Issues opened	12
Issues closed	9
Commits to default branch	0
New releases/tags	0
Failed CI runs	10+

---

Active Repositories

swagger-php

Pull Requests

• ⬆️ Opened: #1977 Migrate bin/openapi to Symfony Console by @yceruto

Refactor from 270-line standalone script to Symfony Console application using #[AsCommand], #[MapInput], and invokable __invoke(). No functional changes — all existing CLI behavior preserved.

Issues — No new issues in the 24-hour window.

Commits (0 to master in last 24h)

Last push: 2026-03-10 (6ffe469 Remove obsolete dependency on ext-json by @DerManoMann)

---

.github

Issues

• 🆕 Opened: 11 automated workflow reports (Smart Alerts ×4, Maintenance Board ×2, Daily Standup, Daily Triage, Daily Review Nudge, Maintenance CI, Org Monitor)
  • Notable: #274 [Alert] Smart Alerts — 2026-03-15T06:33 UTC (escalating subcog security incident)
• ✔️ Closed: 9 superseded automated reports

Commits — 0 to main in last 24h (CI healthy per automated reports)

---

farm-notebook-examples

Issues

• 🆕 Opened: #26 Daily QA 2026-03-14 — no new findings (automated bot)

---

Attention Required

🔴 Security Incident — ESCALATION REQUIRED

subcog #153: Exposed AWS Access Key in src/security/mod.rs @ ad6f61a6

• Age: ~28 hours with zero response as of 06:33 UTC today
• Filed by: External responsible-disclosure scanner (hdhdn)
• Immediate steps:
  1. Revoke the AWS Access Key at console.aws.amazon.com/iam
  2. Remove key from src/security/mod.rs and push fix commit
  3. Purge from git history via git filter-repo or BFG Repo Cleaner
  4. Rotate any dependent services using those credentials
  5. Close subcog#153 once resolved

---

Stale PRs (> 7 days, no activity)

Repo	PR	Title	Opened	Last Update
zircote/.github	#1	ci(deps): bump actions/attest-build-provenance from 3 to 4	—	Stale dependabot
git-notes-memory	#33	feat: security remediation + observability + new tests	2025-12-26	2025-12-27 (draft)
zircote-ansible	#2	some development, needs much more	2014-05-28	2014-06-15 (locked)
(+5 others)	—	—	—	> 7 days stale

Total stale open PRs across org: 8

---

Failing CI on Default Branch

Repo	Workflow	Failing Since	Root Cause
atlatl	CI Checks	~4 days	Clippy 1.94 strict lints + broken doc links
atlatl	Pipeline	~3 days	ONNX Runtime prebuilt targets dropped
atlatl	Code Coverage	~3 days	Cancelled (Pipeline cascade)
atlatl	Security Audit	~2 days	sigstore/cosign-installer v4.1.0 breaking change
atlatl-spec	Validate Specification	~8 days	Invalid HTML <br/> in Mermaid diagram
sdlc-quality	CI	~14 days	Broken since chore: update dependabot configuration
vscode-git-adr	CI	~13 days	actions/upload-artifact v6→v7 breaking change
daedalus	Security Audit	~3 days	sigstore/cosign-installer v4.1.0 breaking change
rlm-rs	Daily QA	~14h	github/gh-aw 0.56.2 breaking change
github-project-manager	Agentic Maintenance	~3 days	github/gh-aw 0.56.2 breaking change

Batch fix available: Pin sigstore/cosign-installer to SHA faadad0cce49287aee09b3a48701e75088a2c6ad (v4.0.0) in both atlatl and daedalus.

---

Security-Related Activity

• subcog #153: Exposed AWS Access Key — 28h unresolved ⚠️ CRITICAL
• subcog #152: feat(http): /healthz endpoint — external contributor PR awaiting review (4d, CI passed)
• atlatl Security Audit CI failing (2d) — sigstore/cosign-installer v4.1.0 regression
• daedalus Security Audit CI failing (3d) — same root cause as atlatl

---

Quiet Repositories

73 repositories with no activity in the last 24 hours

rlm-rs, atlatl, atlatl-spec, daedalus, subcog, sdlc-quality, vscode-git-adr, github-project-manager, homebrew-tap, MIF, lro-bench, git-notes-memory, zircote-ansible, claude-spec-benchmark, zircote.github.io, zircote-cookbooks, zircote-packer, zircote-vagrant, gearman-php, zircote-ansible, hal, amfphp-toolbox, amfphp-2.0, phpixie, php-resque, SilexServiceProviders, sandbox, php-amqplib, ZendSkeletonApplication, Zend_Cache, blog, testapp, docpress, graphql-php-client, php-elasticsearch, php-elastica, s3contents, php-consul, php-units-of-measure, php-geocoder, php-wkhtmltopdf, ZendFramework-Modules, phptwitteroauth, php-activerecord-generator, php-couch, twig-extensions, silex-extras, silex, ZFStatsd, php-eventful, php-soundcloud, php-vimeo, php-youtube, php-disqus, php-rss, php-pager, php-uuid, php-parser, symfony-mongodb-odm, php-solr, Zend_Acl, php-markdown, php-textile, yui3-gallery, sandbox2, zend-form-generator, php-akismet, php-recaptcha, php-facebook, php-twitter, php-flickr, php-amazon-s3, rlm-rs-docs

---

Generated by org-monitor workflow — https://github.com/zircote/.github/actions/runs/23106351075

AI generated by Org Repository Monitor · history

• expires on Mar 22, 2026, 8:08 AM UTC