From 6c5c49f588a70205401d701bf172a6e9982948aa Mon Sep 17 00:00:00 2001
From: Jakob Wennberg <149234542+jakobwennberg@users.noreply.github.com>
Date: Thu, 7 May 2026 23:07:54 +0200
Subject: [PATCH] chore(compliance): upgrade to compliancemaxx@v2 (#419)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* chore(compliance): upgrade to compliancemaxx@v2

Per-PR check switches from `mode: pr` (deterministic scanners) to
`mode: review` (LLM-only diff review, ~90s, ~$0.05/PR). The nightly
audit workflow continues to provide the deeper scanner-backed coverage,
so concrete-pattern findings (secrets, CVEs, IaC misconfigs) are still
caught — just within 24 hours instead of immediately.

Trade-off accepted: PR feedback becomes shorter and more reasoned
(LLM judgement) rather than longer and more pattern-matched (scanner
output). Easier to act on per-PR; deep scanner coverage retained nightly.

  - compliance-pr.yml: @v1 mode:pr → @v2 (default mode: review)
  - compliance-swarm.yml: @v1 mode:swarm → @v2 mode:audit

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: re-trigger to pick up v2.0.1 action.yml fix

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/compliance-pr.yml    | 25 ++++++++++++++++---------
 .github/workflows/compliance-swarm.yml |  4 ++--
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/compliance-pr.yml b/.github/workflows/compliance-pr.yml
index 212f04ff..9494ad5e 100644
--- a/.github/workflows/compliance-pr.yml
+++ b/.github/workflows/compliance-pr.yml
@@ -1,4 +1,9 @@
-name: compliance — PR mode (advisory)
+name: compliance — review (advisory)
+
+# Lightweight LLM-only review on every PR. ~90s, no Docker scanners.
+# Posts a sticky comment with reasoned findings across all 5 frameworks.
+# The nightly compliance-swarm.yml (mode: audit) provides the deeper
+# scanner-backed coverage.
 
 on:
   pull_request:
@@ -7,24 +12,26 @@ on:
 permissions:
   contents: read
   pull-requests: write
-  security-events: write
 
 concurrency:
-  group: compliance-pr-${{ github.ref }}
+  group: compliance-review-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  compliance:
-    name: PR static checks (advisory)
+  review:
+    name: Compliance review (advisory)
     runs-on: ubuntu-latest
-    timeout-minutes: 8
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - uses: erp-mafia/compliancemaxx@v1
+      - uses: erp-mafia/compliancemaxx@v2
         with:
-          mode: pr
           base: ${{ github.event.pull_request.base.sha }}
-          fail-on-findings: false           # advisory while bedding in; flip to true after triage
+          fail-on-findings: false           # advisory while bedding in
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: eu-north-1
diff --git a/.github/workflows/compliance-swarm.yml b/.github/workflows/compliance-swarm.yml
index a55a9969..4489f0d1 100644
--- a/.github/workflows/compliance-swarm.yml
+++ b/.github/workflows/compliance-swarm.yml
@@ -44,9 +44,9 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: erp-mafia/compliancemaxx@v1
+      - uses: erp-mafia/compliancemaxx@v2
         with:
-          mode: swarm
+          mode: audit                    # v2 name; was `swarm` in v1
           llm-provider: bedrock
           fail-on-findings: false        # observational while bedding in
         env: