[dependabot]

Bumps Factory-AI/droid-action from 7 to 8.

Release notes

Sourced from Factory-AI/droid-action's releases.

v8

What's Changed

Review sessions carry a structured tag

• Every review pass now sends --tag with metadata instead of a bare code-review name (#142)
  • {name:"code-review", metadata:{pass, reviewType, platform, repo, pr, runId, runAttempt}} on GitHub and GitLab, for both the candidates and validator passes
  • The tag name is unchanged, so existing code-review filters keep working; the metadata lets analytics identify and pair review sessions without parsing prompt text (GitLab MR !N and dotted repo names were previously misclassified)

No retries after a usage-limit failure

• droid exec stops after the first attempt when the API returns a usage limit (#141)
  • 5-hour/weekly/monthly limits, exhausted Extra Usage, credit limit, and BYOK empty-balance 402s no longer trigger the three-attempt retry, which was opening three failed sessions per review
  • The PR comment now shows the limit's human-readable detail as the error message

Review posting

• Review posting is deterministic and pinned to the validated commit; the validator token is dropped (#138)
• Tracking and inline comments are tagged with their run type (default, unresolved, security), so comments from skipped security runs are no longer posted and combined markers survive edits (#133, @​factory-andrew-seo)
• Bot-authored reviews are allowed in CI (#137)
• GraphQL responses without an envelope no longer crash the PR fetcher (#132)

Maintenance

• Updated default review models (#135)
• Resolved dependency vulnerabilities flagged by the security scan, including the MCP SDK in the mcp-test fixture (#128, #130)

Full Changelog: Factory-AI/droid-action@v7...v8

Commits

• ad22b1d Merge pull request #143 from Factory-AI/dev
• 6eb6011 Merge pull request #142 from Factory-AI/nizar/review-session-tags
• ebfcccc fix(review): quote the logged --tag JSON and document the CLI floor
• 291c19b Merge pull request #141 from Factory-AI/nizar/no-retry-usage-limit
• 952ff29 fix(base-action): do not retry droid exec after a usage-limit failure
• 91d435f feat(review): send structured session tag on every review pass
• 6449c2c Merge pull request #132 from Factory-AI/sf/can-you-monitor-linear-and-the/2a9...
• f77cac7 Update test/github/data/pr-fetcher.test.ts
• b46affd Merge pull request #133 from Factory-AI/andrew/factory-pr-review
• 9ffc2aa fix(review): preserve combined tracking comment markers
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #70.