chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• reference_packs.py: Validates and resolves reference pack configuration for shared runner prompt assembly
• orchestrator_skill.py: Validates and resolves exported Orchestrator skill context for remote Codex lanes
• runner_lib/ (1 files): Shared runner prompt assembly, output parsing, and dispatch debounce helpers

Files Skipped

• pr-00-gate.yml: File exists and sync_mode is create_only
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: 1bc0f231da20f5596199ce25d3923f9230ac4b76
Template hash: b653eb470804
Sync branch: sync/workflows-b653eb470804
Consumer repo: stranske/Counter_Risk
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Repository string validation now enforces strict owner/name format
  • Improved orchestrator skill context handling and initialization

• Chores

  • Updated workflow infrastructure components

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 606efa05-ec82-4ddd-a34e-8ee37f6322d4

📥 Commits

Reviewing files that changed from the base of the PR and between 4de39b5 and c3fd3ea.

📒 Files selected for processing (4)

• .github/workflows/agents-guard.yml
• scripts/orchestrator_skill.py
• scripts/reference_packs.py
• scripts/runner_lib/core.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (5)

**/*.py

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

In Manager-Database repository, import Prefect 2.x schedules from prefect.client.schemas.schedules

Files:

• scripts/orchestrator_skill.py
• scripts/reference_packs.py
• scripts/runner_lib/core.py

**/{.github/workflows/agents-*.yml,.github/workflows/autofix.yml,.github/codex/**,scripts/**,docs/**}

📄 CodeRabbit inference engine (CLAUDE.md)

Agent workflow files (agents-*.yml), autofix.yml, .github/codex/ prompts, and synced scripts/docs should be fixed in stranske/Workflows, not locally in the consumer repo.

Files:

• scripts/orchestrator_skill.py
• .github/workflows/agents-guard.yml
• scripts/reference_packs.py
• scripts/runner_lib/core.py

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.yml: Do not add top-level permissions: block on workflow_call reusable workflows - this conflicts with caller permissions
Avoid invalid YAML syntax, invalid permission scopes, and circular workflow references when creating GitHub Actions workflows

Files:

• .github/workflows/agents-guard.yml

**/.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

First-party consumers should reference reusable workflows with @main. Match that unless you are intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (AGENTS.md)

Agent workflow files (agents-*.yml) should be fixed in stranske/Workflows, not edited locally in the consumer repository

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context stranske/Workflows

Based on my exploration of the Workflows repository, I have sufficient context to complete this research.

Summary of Cross-Repository Findings

The PR is syncing critical updates from commit 1bc0f231da20f5596199ce25d3923f9230ac4b76 which hardens the orchestrator skill materialization pipeline. Here are the key cross-repo impacts:

stranske/Workflows — Repository Validation Changes [::stranske/Workflows::]

Breaking Change in Validation Logic:

• Both scripts/reference_packs.py and scripts/orchestrator_skill.py now enforce strict owner/name format validation by splitting on "/" and requiring exactly 2 non-empty parts
• Previously accepted formats now rejected:
  • trend/research/extra (nested paths with 3+ segments)
  • owner/repo/extra (same pattern)
• Validation is consistent: bootstrap_consumer_settings.py already uses identical _split_repo() validation pattern, confirming this is the established convention [::stranske/Workflows::]

Test Coverage Documents Breaking Changes:

• tests/scripts/test_reference_packs.py:test_parse_reference_packs_rejects_nested_repo_names() — validates rejection of trend/research/extra format
• tests/scripts/test_orchestrator_skill.py:test_parse_rejects_nested_repo_names() — validates rejection of owner/repo/extra format [::stranske/Workflows::]

Runner Library Improvements:

• scripts/runner_lib/core.py:materialize_orchestrator_skill() now suppresses FileNotFoundError when removing stale checkout paths via contextlib.suppress(FileNotFoundError) — prevents failures during re-materialization [::stranske/Workflows::]
• scripts/runner_lib/core.py:assemble_prompt() enhanced to handle two paths:
  1. Materialization enabled: uses path returned by materialize_orchestrator_skill()
  2. Materialization disabled: reads orchestrator_skill_summary_path from context (relative to workspace if needed)
  • "Orchestrator Skill Context" section only included if resolved summary path exists [::stranske/Workflows::]

Configuration Documentation:

• .github/orchestrator_skill.json can reference a named pack from .github/reference_packs.json or use inline repository checkout
• Both configuration files use "repo" field that must now strictly follow owner/name format [::stranske/Workflows::]

Risk Assessment for Counter_Risk:

The validation change IS a breaking change IF:

• Counter_Risk has .github/reference_packs.json with any repo field using nested paths (e.g., org/team/repo)
• Counter_Risk has .github/orchestrator_skill.json with any repo field using nested paths

The validation change is NOT breaking IF:

• All repo references in Counter_Risk configuration already use strict owner/name format
• Counter_Risk does not yet have these configuration files (they are optional, created on-demand)

🔇 Additional comments (8)

.github/workflows/agents-guard.yml (1)

114-114: LGTM!

Also applies to: 183-183

scripts/orchestrator_skill.py (1)

82-86: LGTM!

scripts/reference_packs.py (1)

85-89: LGTM!

scripts/runner_lib/core.py (5)

8-8: LGTM!

---

359-391: LGTM!

---

418-431: LGTM!

---

461-467: LGTM!

---

955-955: LGTM!

---

📝 Walkthrough

Walkthrough

Two Python scripts (orchestrator_skill.py, reference_packs.py) tighten _validate_repo to require exactly two non-empty owner/name segments. runner_lib/core.py makes orchestrator checkout cleanup idempotent, resolves the orchestrator summary path dynamically in assemble_prompt(), and wires ORCHESTRATOR_SKILL_SUMMARY_PATH through the CLI context. The CI workflow updates one pinned action SHA.

Changes

Python script fixes and orchestrator prompt path

Layer / File(s)	Summary
Repo owner/name validation tightening scripts/orchestrator_skill.py, scripts/reference_packs.py	_validate_repo in both files now splits on / and asserts exactly two non-empty segments, rejecting strings like a/b/c that the prior slash-presence check allowed.
Orchestrator skill materialization, prompt path resolution, and CLI wiring scripts/runner_lib/core.py	Adds contextlib import and wraps shutil.rmtree(checkout_path) in contextlib.suppress(FileNotFoundError). assemble_prompt() captures the path returned by materialize_orchestrator_skill() or reads orchestrator_skill_summary_path from context (resolved relative to workspace if not absolute), and appends the orchestrator section only when that path exists as a file. _cmd_assemble sets orchestrator_skill_summary_path from the ORCHESTRATOR_SKILL_SUMMARY_PATH env var.

CI workflow action pin update

Layer / File(s)	Summary
Update setup-api-client pinned commit SHA .github/workflows/agents-guard.yml	Both pull_request_target and pull_request job steps update the stranske/Workflows/.github/actions/setup-api-client pinned commit hash to the new SHA.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• stranske/Counter_Risk#757: Updates the same setup-api-client pinned digest in .github/workflows/agents-guard.yml, directly matching the workflow pin change in this PR.
• stranske/Counter_Risk#758: Also changes the pinned stranske/Workflows/.github/actions/setup-api-client commit SHA in the same workflow file.
• stranske/Counter_Risk#762: Modifies orchestrator skill materialization and prompt wiring in scripts/runner_lib/core.py and scripts/orchestrator_skill.py, the same files modified by this PR's core changes.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title 'chore: sync workflow templates' is only partially related to the changeset. While the workflow file is updated, the PR primarily syncs multiple scripts (orchestrator_skill.py, reference_packs.py, runner_lib/core.py) with significant logic changes, not just workflow templates.	Revise the title to reflect that this is a template sync that includes script updates. Consider: 'chore: sync workflow templates and scripts from stranske/Workflows' or 'chore: sync templates and runner scripts from upstream.'
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-b653eb470804

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[stranske]

Closing as stale: newer replacement #764 exists from sync/workflows-76689bc445fd.