fix(ci): recognize issue references on v2 PRs

.github/workflows/pr-standards.yml

@@ -135,7 +135,16 @@ jobs:
 
             const linkedIssues = result.repository.pullRequest.closingIssuesReferences.totalCount;
 
-            if (linkedIssues === 0) {
+            // GitHub only populates closingIssuesReferences when a PR targets the repository's
+            // default branch (dev). PRs targeting other branches like v2 always return totalCount 0.
+            // Fall back to checking the PR description for closing keywords (e.g. Closes #123).
+            const body = pr.body || '';
+            const issueMatch = body.match(/### Issue for this PR\s*\n([\s\S]*?)(?=###|$)/);
+            const issueContent = issueMatch ? issueMatch[1].trim() : body;
+            const hasBodyIssueRef = /(closes|fixes|resolves)\s+#\d+/i.test(issueContent) || /#\d+/.test(issueContent);
+            const hasLinkedIssue = linkedIssues > 0 || hasBodyIssueRef;
+
+            if (!hasLinkedIssue) {
               await addLabel('needs:issue');
               await comment('issue', `Thanks for your contribution!
 

.github/workflows/publish.yml

@@ -117,88 +117,6 @@ jobs:
     outputs:
       version: ${{ needs.version.outputs.version }}
 
-  sign-cli-macos:
-    needs:
-      - build-cli
-      - version
-    runs-on: macos-26
-    if: github.repository == 'anomalyco/opencode'
-    steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
-
-      - uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
-        with:
-          keychain: build
-          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
-          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: opencode-cli
-          path: packages/opencode/dist
-
-      - name: Setup git committer
-        id: committer
-        uses: ./.github/actions/setup-git-committer
-        with:
-          opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
-          opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
-
-      - name: Sign macOS CLI binaries
-        run: |
-          identity=$(security find-identity -v -p codesigning build.keychain | sed -n 's/.*"\(Developer ID Application:.*\)"/\1/p' | head -n 1)
-          if [ -z "$identity" ]; then
-            echo "Developer ID Application identity not found"
-            exit 1
-          fi
-
-          for name in opencode-darwin-arm64 opencode-darwin-x64 opencode-darwin-x64-baseline; do
-            file="packages/opencode/dist/$name/bin/opencode"
-            chmod +x "$file"
-            codesign \
-              --force \
-              --timestamp \
-              --options runtime \
-              --entitlements packages/opencode/script/entitlements.plist \
-              --sign "$identity" \
-              "$file"
-            codesign --verify --deep --strict --verbose=4 "$file"
-            codesign --display --requirements - "$file"
-          done
-
-      - name: Smoke test signed binary
-        run: ./packages/opencode/dist/opencode-darwin-arm64/bin/opencode --version
-
-      - name: Repack macOS CLI archives
-        working-directory: packages/opencode/dist
-        run: |
-          for name in opencode-darwin-arm64 opencode-darwin-x64 opencode-darwin-x64-baseline; do
-            rm -f "$name.zip"
-            (cd "$name/bin" && zip -r "../../$name.zip" *)
-          done
-
-      - name: Upload signed macOS CLI release assets
-        if: needs.version.outputs.release != ''
-        env:
-          GH_TOKEN: ${{ steps.committer.outputs.token }}
-        run: |
-          gh release upload "v${{ needs.version.outputs.version }}" \
-            packages/opencode/dist/opencode-darwin-arm64.zip \
-            packages/opencode/dist/opencode-darwin-x64.zip \
-            packages/opencode/dist/opencode-darwin-x64-baseline.zip \
-            --clobber \
-            --repo "${{ needs.version.outputs.repo }}"
-
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: opencode-cli-signed-macos
-          path: |
-            packages/opencode/dist/opencode-darwin-arm64
-            packages/opencode/dist/opencode-darwin-x64
-            packages/opencode/dist/opencode-darwin-x64-baseline
-            packages/opencode/dist/opencode-darwin-*.zip
-          if-no-files-found: error
-
   sign-cli-windows:
     needs:
       - build-cli
@@ -487,7 +405,6 @@ jobs:
     needs:
       - version
       - build-cli
-      - sign-cli-macos
       - sign-cli-windows
       - build-electron
     if: always() && !failure() && !cancelled()
@@ -520,14 +437,6 @@ jobs:
           name: opencode-cli
           path: packages/opencode/dist
 
-      - name: Remove unsigned macOS CLI binaries
-        run: rm -rf packages/opencode/dist/opencode-darwin*
-
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: opencode-cli-signed-macos
-          path: packages/opencode/dist
-
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: opencode-cli-windows

packages/opencode/script/entitlements.plist

@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>com.apple.security.cs.allow-jit</key>
-    <true/>
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-    <true/>
-    <key>com.apple.security.cs.disable-executable-page-protection</key>
-    <true/>
-    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
-    <true/>
-    <key>com.apple.security.cs.disable-library-validation</key>
-    <true/>
-</dict>
-</plist>