* test: assert the dbt sslrootcert path with the platform separator
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: let check-docs-links tolerate a link pending a docs deploy
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: fail check-docs-links on a stale pending-deploy entry
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: narrow the pending-deploy exemption to a 404
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* ci for broken links + fix broken links
* ci: replace expiring-PAT org membership gate with author_association
The shared check-org-membership.yml reusable workflow authenticated to the
GitHub API with the ORG_ACCESS_TOKEN PAT to confirm org membership. That PAT
expired ~1 year after issuance, so the API could no longer see private org
members and check-membership emitted is_member=false — silently skipping every
auto-review, command-triggered review, /ai, /plan, and git-command job while
still reporting success.
Gate on the event payload's author_association (OWNER/MEMBER/COLLABORATOR)
instead, which comes from the built-in GITHUB_TOKEN and never expires. The
trusted internal bot and existing draft/fork/command guards are preserved; the
workflow_call paths stay open as trusted upstream. Deletes the now-unused
reusable workflow.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ruben Fiszel