chore(orc): upgrade orc-standards to v8.0.0 - #328
Conversation
Re-rendered by `orc adopt`; committing the managed adapter so the render propagates through git instead of stranding as an uncommitted working-tree change (the structural cause of fleet adapter drift, #1838). Co-Authored-By: ORC (macbookprom5) <orc@orc.local> Signed-off-by: orc <orc@orc.local>
deffenda
added
the
chore:trivial
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: eb8c30e2c7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| echo "::notice::run-presence-check: PR #$PR_NUMBER has no linked ticket; run-presence is not required." | ||
| exit 0 |
There was a problem hiding this comment.
For any human-authored PR that omits a closing issue reference and uses a non-ticket branch name, this now exits successfully before checking evidence. Because this workflow is the required run-presence check, an AI-authored PR can bypass the ticket contract merely by deleting its link; this directly reverses the preceding #2511 fail-closed behavior, while the new bot-specific block already handles Dependabot separately. Restore the failure for non-bot, non-exempt PRs.
AGENTS.md reference: AGENTS.md:L5-L7
Useful? React with 👍 / 👎.
| # expressible in a workflow `permissions:` block. Use the token convention the sibling | ||
| # baseline workflow already established (#2578) so an adopter that HAS provisioned the | ||
| # secret gets a real audit instead of a permanent red. | ||
| GH_TOKEN: ${{ secrets.ORC_GUARDS_TOKEN || github.token }} |
There was a problem hiding this comment.
When ORC_GUARDS_TOKEN is provisioned exactly as the sibling workflows direct—a PAT or App token with read access only to private ABD-Enterprises/orc—this expression replaces github.token with a credential that cannot access repos/$REPO. The default-branch request then falls back to main, and the protection request's Not Found response is interpreted as an unprotected branch, so real merge overrides are skipped without audit evidence. Use a token explicitly scoped to the adopter repository as well, or distinguish authorization-related 404 responses from genuinely unprotected branches.
AGENTS.md reference: AGENTS.md:L12-L12
Useful? React with 👍 / 👎.
Re-renders the ORC-managed adapter from orc-standards v8.0.0 (was v7.17.0, pinned 2026-07-13).
Release notes: https://github.com/ABD-Enterprises/orc/releases/tag/v8.0.0
Generated by
orc adopt --force --with-workflows. Only ORC-managed files change.What this actually fixes here
run-presenceexempts bot-authored PRs. A Dependabot PR has no ORC ticket by construction, so a requiredrun-presencecheck could never be satisfied and the PR could never merge:46 bot PRs were deadlocked across 8 repos on v7.17.0. The exemption keys off GitHub's own
author.is_bot, with the[bot]login suffix as a fallback — neither is user-claimable.run-presenceno longer cancels its own in-flight run.labeled,unlabeledandeditedare triggers, and ORC changes labels and edits PRs as normal operation — sofinish-pr's own attestation cancelled the run in flight, and GitHub reported the cancellation asfailureon a PR nothing was wrong with. Serialisation by concurrency group is retained.The code-guards bundle is fetched at an immutable commit, not a mutable tag, and refuses to run guards from an unexpected commit rather than passing quietly.
Review note
The diff is entirely regenerated adapter output — no hand edits. If any file here was locally customised, say so and it will be re-rendered with that carve-out rather than overwritten.