chore: retire the licence-grant workflow

README.md

@@ -7,12 +7,6 @@ This repository holds organisation-wide files for Orbyn projects, starting with
 
 Contact: hello@orbyn.dev
 
-## Licence grant check (in force)
-
-`.github/workflows/licence-grant.yml` is an interim check for pull requests from outside the organisation, until the contributor licence agreement is approved. The author posts one licence-grant sentence on their pull request, and the "Licence grant" status turns green. Organisation members and bots pass at once.
-
-Product repositories call it from `examples/licence-grant-caller.yml`.
-
 ## Contributor agreement check
 
 `.github/workflows/cla.yml` is a reusable check for the [contributor agreement](CLA.md). A contributor comments `/orbynAgree` once on their own pull request; that covers every covered Orbyn repository. Organisation members and bots pass at once. The skills library (`orbyn-fullstack-skills`) stays MIT with a DCO and is not covered.
@@ -22,7 +16,7 @@ Product repositories call it from `examples/licence-grant-caller.yml`.
 1. Copy [`examples/cla-caller.yml`](examples/cla-caller.yml) to `.github/workflows/cla.yml`, or run `scripts/enable-cla.sh <repo>`, which opens a pull request doing exactly that (it does not touch branch protection or secrets).
 2. Make sure the organisation secret `CLA_SIGNATURES_TOKEN` is available to the repository (limit it to the covered repositories). The caller must pass the `agreement-version` input; it has no default.
 3. Require the status check `CLA` on the default branch.
-4. Settings, Actions, General: set fork pull request workflows to "Require approval for all outside collaborators", and look at any change under `.github/workflows` before approving. A fork PR workflow can post a status with the same name, so the required check alone is not proof. A dedicated GitHub App that posts the status is the planned stronger fix. The old "Licence grant" check has the same exposure.
+4. Settings, Actions, General: set fork pull request workflows to "Require approval for all outside collaborators", and look at any change under `.github/workflows` before approving. A fork PR workflow can post a status with the same name, so the required check alone is not proof. A dedicated GitHub App that posts the status is the planned stronger fix.
 
 Exemptions are by numeric account id (`allowed` input) and by `MEMBER`/`OWNER` association. A private organisation member reads as `CONTRIBUTOR`, so they should make their membership public or be listed by id.
 

REVIEW.md

@@ -43,7 +43,7 @@
 
 ## Known limits and follow-ups
 
-- **A required status can be faked.** A workflow in a fork PR can contain a job that posts a status named `CLA` (or whose check has the same name). Interim mitigation: in each covered repository set Settings, Actions, General, "Fork pull request workflows from outside collaborators" to "Require approval for all outside collaborators", and reviewers look at any change under `.github/workflows` before approving a run. The stronger fix is a dedicated GitHub App that posts the status, with that app set as the required source of `CLA`; this is a follow-up. The older "Licence grant" check has the same exposure.
+- **A required status can be faked.** A workflow in a fork PR can contain a job that posts a status named `CLA` (or whose check has the same name). Interim mitigation: in each covered repository set Settings, Actions, General, "Fork pull request workflows from outside collaborators" to "Require approval for all outside collaborators", and reviewers look at any change under `.github/workflows` before approving a run. The stronger fix is a dedicated GitHub App that posts the status, with that app set as the required source of `CLA`; this is a follow-up.
 - **Existing contributors without an open PR** (for example Luan) can agree by commenting `/orbynAgree` on any old pull request of theirs: the check also runs on comments, so this records the signature for every covered repository.
 - **The token expires.** A fine-grained personal access token expires, and then every check ends in an error until it is renewed. A GitHub App installation token is the better long-term option. Limit the org secret `CLA_SIGNATURES_TOKEN` to the covered repositories.
 
@@ -55,4 +55,4 @@ Nothing runs until these steps are done, and the only manual ones are:
 2. Anh runs `scripts/enable-cla.sh <repo>` for `orbyn-engine`, `orbyn-planner`, `orbyn-engineering`, `orbyn.dev` and `orbyn-notes`, and merges the pull request each opens.
 3. Anh requires the status check `CLA` on each repository's default branch, and sets "Require approval for all outside collaborators" for fork pull request workflows.
 
-The older "Licence grant" check (`licence-grant.yml`) stays in force until Anh switches over.
+The older "Licence grant" check was retired on 2026-11-08, once `CLA` was required in every covered repository.