chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• reference_packs.py: Validates and resolves reference pack configuration for shared runner prompt assembly
• orchestrator_skill.py: Validates and resolves exported Orchestrator skill context for remote Codex lanes
• runner_lib/ (1 files): Shared runner prompt assembly, output parsing, and dispatch debounce helpers

Files Skipped

• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: 1bc0f231da20f5596199ce25d3923f9230ac4b76
Template hash: b653eb470804
Sync branch: sync/workflows-b653eb470804
Consumer repo: stranske/Template
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• Bug Fixes

  • Repository field validation now enforces strict owner/name format, rejecting invalid inputs with additional path segments.

• Chores

  • Updated workflow fallback action versions for improved reliability.
  • Refined orchestrator skill context materialization and file path handling logic.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 682252e5-e254-490d-8d6e-beb623dd1306

📥 Commits

Reviewing files that changed from the base of the PR and between 9cdbef3 and d2f1250.

📒 Files selected for processing (4)

• .github/workflows/agents-guard.yml
• scripts/orchestrator_skill.py
• scripts/reference_packs.py
• scripts/runner_lib/core.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (5)

**/*.py

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

In Manager-Database repository using Prefect 2.x, import schedules from prefect.client.schemas.schedules rather than other locations

Files:

• scripts/orchestrator_skill.py
• scripts/reference_packs.py
• scripts/runner_lib/core.py

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.{yml,yaml}: Ensure coverage threshold settings in GitHub Actions workflow files for coverage-min match the [tool.coverage.report] fail_under setting in pyproject.toml, as the lower value will be the effective threshold
For startup_failure in GitHub Actions workflows with zero jobs, check for invalid YAML syntax, top-level permissions: blocks in workflow_call reusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references

Files:

• .github/workflows/agents-guard.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (AGENTS.md)

Agent workflows (agents-*.yml), autofix.yml, synced prompts in .github/codex/, and synced scripts/docs should be fixed in stranske/Workflows, not in the consumer repository

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context stranske/Workflows

Based on my exploration of the stranske/Workflows repository, I have gathered sufficient cross-repository context to inform the review. Here are my findings:

Linked repositories findings

stranske/Workflows

Validation Logic Strictness Change

The _validate_repo function changes in both scripts/orchestrator_skill.py and scripts/reference_packs.py implement stricter validation that breaks configurations with nested repository paths (e.g., owner/repo/extra).

Before: The validation only checked for the presence of / and absence of leading/trailing slashes, which allowed inputs like a/b/c to pass.

After: The validation now splits on / and requires exactly two non-empty segments (owner/name format only).

This is validated by test cases in the source repository:

• tests/scripts/test_orchestrator_skill.py — test_parse_rejects_nested_repo_names() expects OrchestratorSkillConfigError when given "owner/repo/extra" [::stranske/Workflows::]
• tests/scripts/test_reference_packs.py — test_parse_reference_packs_rejects_nested_repo_names() similarly rejects "trend/research/extra" [::stranske/Workflows::]
• tests/scripts/test_bootstrap_consumer_settings.py — parameterized test confirms "a/b/c" is now rejected [::stranske/Workflows::]

Impact: Any .github/orchestrator_skill.json or .github/reference_packs.json files in consumer repositories that specify repository references with more than two path segments will fail validation after this sync.

Orchestrator Skill Context Materialization Hardening

Changes in scripts/runner_lib/core.py improve safety and flexibility of orchestrator skill context handling [::stranske/Workflows::]

Key changes:

1. File existence check — The orchestrator skill context section is now only appended to the final prompt when orchestrator_summary_path exists as a file (lines with if orchestrator_summary_path and orchestrator_summary_path.is_file())
2. Dynamic path resolution — Instead of always referencing fixed .reference/ORCHESTRATOR_SKILL.md, the code now:
   • Uses ORCHESTRATOR_SKILL_SUMMARY_PATH environment variable if provided
   • Resolves relative paths against the workspace
3. Safe cleanup — Uses contextlib.suppress(FileNotFoundError) when deleting existing checkout paths (prevents errors if path doesn't exist)

These changes are part of commit 1bc0f231da20f5596199ce25d3923f9230ac4b76 with the message "fix: harden orchestrator skill materialization" [::stranske/Workflows::]

Workflow Reference Update

The .github/workflows/agents-guard.yml fallback action reference to stranske/Workflows/.github/actions/setup-api-client was updated from commit c2537cc to d68de190 (v1). The setup-api-client action is a composite action that manages GitHub API client dependencies and token load balancing across workflow jobs [::stranske/Workflows::]

---

🔇 Additional comments (4)

scripts/reference_packs.py (1)

86-87: LGTM!

scripts/runner_lib/core.py (1)

8-8: LGTM!

Also applies to: 370-376, 419-431, 461-465, 955-955

scripts/orchestrator_skill.py (1)

83-84: This verification request is misplaced — the template repository doesn't contain consumer configs.

Lines 83–84 correctly enforce owner/name format validation. However, stranske/Template is the library providing this validation, not a consumer. Consumer repositories (which would have .github/orchestrator_skill.json or .github/reference_packs.json files) are responsible for verifying their own configs comply with the stricter format. Verification in the template repository itself is not applicable.

.github/workflows/agents-guard.yml (1)

114-114: LGTM!

Also applies to: 183-183

---

📝 Walkthrough

Walkthrough

Two scripts (orchestrator_skill.py, reference_packs.py) have their _validate_repo function tightened to require exactly two non-empty owner/name segments. runner_lib/core.py adds cleanup before reference pack materialization and makes the orchestrator summary path dynamic in prompt assembly. The agents-guard.yml workflow updates a pinned action digest.

Changes

Script: Repo Validation and Orchestrator Skill Core

Layer / File(s)	Summary
Strict owner/name repo validation scripts/orchestrator_skill.py, scripts/reference_packs.py	Both _validate_repo functions replace boundary slash checks with a split("/") requiring exactly two non-empty parts, rejecting extra path segments and empty owner or name components.
Orchestrator skill materialization and prompt path resolution scripts/runner_lib/core.py	contextlib is imported; checkout_path is deleted (suppressing FileNotFoundError) before materialize_reference_packs; assemble_prompt captures the returned summary path or resolves it from context against the workspace; the Orchestrator Skill Context prompt section is now gated on the resolved path existing as a file; _cmd_assemble injects ORCHESTRATOR_SKILL_SUMMARY_PATH from env into context.

Workflow Pin Bump

Layer / File(s)	Summary
Bump agents-guard workflow action digest .github/workflows/agents-guard.yml	Both fallback uses: stranske/Workflows/.github/actions/setup-api-client@... references are updated to the new d68de190 (v1) digest in both the pull_request_target and pull_request branches.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• stranske/Template#834: Touches the same agents-guard.yml fallback action pin for both pull_request_target and pull_request branches, swapping the same digest values.
• stranske/Template#835: Updates the same workflow fallback in agents-guard.yml by pinning setup-api-client to a newer commit SHA.
• stranske/Template#836: Introduces and extends the Orchestrator Skill module and core prompt materialization flow that this PR modifies in scripts/runner_lib/core.py.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The PR title 'chore: sync workflow templates' is vague and generic. While technically related to the changeset (which includes workflow updates), it fails to capture the substantial changes to validation logic and runtime behavior in Python scripts that constitute the main substance of this PR.	Consider a more descriptive title that reflects the full scope, such as 'chore: sync workflow templates and refine repository validation logic' or separate into multiple PRs if the changes warrant it.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-b653eb470804

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[stranske-keepalive]

Automated Status Summary

Head SHA: 987745d
Latest Runs: ⏳ pending — Gate
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[stranske]

Closing as stale: newer replacement #841 exists from sync/workflows-76689bc445fd.