From 617d3041b1fe439285f2580638a3212e0ba5cc0a Mon Sep 17 00:00:00 2001
From: kathrina - trustabl <kathrina.marcelino@mph-intl.com>
Date: Tue, 18 Aug 2026 17:20:40 +0800
Subject: [PATCH 1/4] Add Trustabl security scanning workflow

---
 .github/workflows/trustabl.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/trustabl.yml

diff --git a/.github/workflows/trustabl.yml b/.github/workflows/trustabl.yml
new file mode 100644
index 0000000..f4d235b
--- /dev/null
+++ b/.github/workflows/trustabl.yml
@@ -0,0 +1,33 @@
+name: Trustabl Agent Scanner
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+# Minimal top-level permissions; write grants are scoped to the scan job only.
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    concurrency:
+      group: trustabl-${{ github.ref }}
+      cancel-in-progress: true
+    permissions:
+      contents: read
+      security-events: write
+      pull-requests: write
+    # continue-on-error keeps this job advisory — findings are reported but
+    # CI does not go red so unrelated work is never blocked.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: trustabl/trustabl-action@973f666d20b5fbb2e6a4511bd3846e965a08c28b # v0.4.1
+        with:
+          version: v0.1.6

From 3b0e32584f6f9873e2447febb4a6ce16b0315fc0 Mon Sep 17 00:00:00 2001
From: Therealdk8890 <35633053+Therealdk8890@users.noreply.github.com>
Date: Tue, 18 Aug 2026 12:08:57 -0500
Subject: [PATCH 2/4] Harden Trustabl CI integration

---
 .github/workflows/trustabl.yml | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/trustabl.yml b/.github/workflows/trustabl.yml
index f4d235b..bdf1788 100644
--- a/.github/workflows/trustabl.yml
+++ b/.github/workflows/trustabl.yml
@@ -6,7 +6,6 @@ on:
   pull_request:
   workflow_dispatch:
 
-# Minimal top-level permissions; write grants are scoped to the scan job only.
 permissions:
   contents: read
 
@@ -14,20 +13,30 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+
     concurrency:
       group: trustabl-${{ github.ref }}
       cancel-in-progress: true
+
     permissions:
       contents: read
       security-events: write
-      pull-requests: write
-    # continue-on-error keeps this job advisory — findings are reported but
-    # CI does not go red so unrelated work is never blocked.
+
     continue-on-error: true
+
+    env:
+      TRUSTABL_TELEMETRY: disabled
+
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
-      - uses: trustabl/trustabl-action@973f666d20b5fbb2e6a4511bd3846e965a08c28b # v0.4.1
+
+      - name: Scan AI agent reliability
+        uses: trustabl/trustabl-action@973f666d20b5fbb2e6a4511bd3846e965a08c28b # v0.4.1
         with:
           version: v0.1.6
+          upload-sarif: true
+          comment-on-pr: false
+          upload-artifact: false

From 4728791d6f49bc61d6087f99a922b9a0210a4184 Mon Sep 17 00:00:00 2001
From: Therealdk8890 <35633053+Therealdk8890@users.noreply.github.com>
Date: Tue, 18 Aug 2026 12:30:56 -0500
Subject: [PATCH 3/4] test: bound CrewAI agent iterations

---
 tests/integrations/test_crewai.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/integrations/test_crewai.py b/tests/integrations/test_crewai.py
index 8062d07..9deb8db 100644
--- a/tests/integrations/test_crewai.py
+++ b/tests/integrations/test_crewai.py
@@ -569,6 +569,7 @@ def _fake_create(self, *args, **kwargs):
         backstory="A meticulous researcher",
         llm=llm,
         verbose=False,
+        max_iter=2                      
     )
     task = Task(
         description="Summarize the latest in AI agent testing",

From 7c50b812aa3789d3376445c62666b992d33e7cf2 Mon Sep 17 00:00:00 2001
From: Therealdk8890 <35633053+Therealdk8890@users.noreply.github.com>
Date: Tue, 18 Aug 2026 12:37:19 -0500
Subject: [PATCH 4/4] style: clean CrewAI max_iter formatting

---
 tests/integrations/test_crewai.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/integrations/test_crewai.py b/tests/integrations/test_crewai.py
index 9deb8db..df5649a 100644
--- a/tests/integrations/test_crewai.py
+++ b/tests/integrations/test_crewai.py
@@ -569,7 +569,7 @@ def _fake_create(self, *args, **kwargs):
         backstory="A meticulous researcher",
         llm=llm,
         verbose=False,
-        max_iter=2                      
+        max_iter=2,
     )
     task = Task(
         description="Summarize the latest in AI agent testing",