Rely on releases for checks, affiliations fixes and orcha dev vars

[slint]

Depends on inveniosoftware/orcha#95

• feat(orcha): point local instances at a local ORCHA
  Running the extraction workflows locally took three exported env vars and,
  before that, a hand-generated key pair. IS_LOCAL_DEV already tells us when
  ZENODO_ENV is unset, so the local defaults belong here rather than in
  everyone's shell.

  Deployments are unaffected: they set ZENODO_ENV, which keeps the sandbox URL,
  the tenant key and the orcha-access permission check.

• fix(quota): implement changes introduced in rdm-records

• fix(quota): enable quota extension to any user

  • remove the check to limit the quota extension feature only to verified
    users

• feat(fixtures): update awards and add affiliations

  • Add website, short_description and description for awards (so
    that we can run the funding relevance check). Also, link to
    organizations via ROR id only.
  • Add affiliations fixtures for all the referenced awards organization
    IDs.

• installation: bump dependencies
  📁 invenio-access (7.0.1 -> 7.0.2 🐛)

  release: v7.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-accounts (9.0.1 -> 9.1.0 🌈)

  release: v9.1.0
  fix(i18n): include *.mo files in distribution
  
  * The *.mo files are necessary for translation, but are included
  in `.gitignore` which causes hatchling to skip them by default
  * they get added by the `pybabel compile` step on release
  cli: don't allow role changes on externally managed
  feat: support unmanaged roles with distinct id and name
  
  * Adds __init__ to Role to set is_managed before other attributes,
    ensuring id/name setters behave correctly during construction. Managed
    roles still enforce id==name but unmanaged roles (is_managed=False)
    allow them to differ and permit name changes after persistence.
  feat: enforce Role id and name are equal
  
  * Uses hybrid properties on both `id` and `name` to keep them in sync.
    Setting either field updates both column. The `name` setter raises a
    `ValueError` on already persisted roles to prevent unwanted primary
    key changes.
  
  * There is a companion change on Invenio-App-RDM that updates old
    database to keep name an id in sync and all the tables that reference
    them
  

  📁 invenio-administration (7.1.0 -> 7.1.1 🐛)

  release: v7.1.1
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-app-rdm (15.0.0b0.dev0 -> 15.0.0b3.dev0 🚀)

  📦 release: v15.0.0b3.dev0
  chore(deps): bump invenio-rdm-records to v35.x
  fix(request_ui): properly fetch subcommunity checks
  fix(requests): pass community_id to get_runs
  feat(requests): added endpoint to trigger rerunning a check
  feat(ui): add anchor for active tab across page reloads
  
  Add URL hash tracking to the rdm-tab-menu tabs, so reloading the page
  restores the previously active tab. This is particularly useful given
  that async Checks may require a page reload.
  views: added comunity slug in request render template
  feat(checks): add subcommunity checks tab
  release: v15.0.0b2.dev1
  feat(search): add overridable ids for result item labels
  previewer: enable ZIP preview for draft records
  
  Previously, previewing ZIP files on draft records failed because the
  code always used the published files service.
  
  * check for record type during ZIP preview
  * use draft file service for draft records
  fix(theme): keep details-list custom field links inline
  fix(administration): role ui depends on groups
  
  * disable role ui on the administration view if
    USERS_RESOURCES_GROUPS_ENABLED==False
  
  * role ui needs the groups services to retrieve the information. if
    groups are disabled, the services doesn't work, therefore the ui gets
    a oops
  fix(build): include mo files
  chore(v14/migration): restructure script
  
  * to enable the request comment feature it is enough to run following
    steps which are included into the normal upgrade guide:
    - invenio index destroy --yes-i-know
    - invenio index init
    - invenio rdm rebuild-all-indices
  
  * the dissertation vocabulary change is optional and the script is moved
    to docs-invenio-rdm
  config: fix citation styles for Vancouver and Chicago with csl 1.0.2
  fix(creatibutors): add selector for modal close button
  release: v15.0.0b2.dev0
  fix(creatibuors.html): normalize search and clean-up CSS classes
  feat(Creatibutors): landing-page show-all modal with searching
    * On the record landing page, long author/contributor lists show "et al." with a searchable modal instead of rendering every name inline.
    * Pass creatibutors_inline_list_threshold and creatibutors_render_batch_size from deposits.py into the deposit form
  fix: unify command with documentation
  fix: adding server default for system_created
  fix: migration step for removal of user_id column from the transaction table
  Apply suggestion from @yarikoptic
  
  Create SECURITY.md
  files: improve external file size display
  release: v15.0.0b1.dev0
  chore(setup): migrate from setuptools to hatchling
  
  * remove MANIFEST.in because that's only relevant for setuptools
  * translate the i18n/translation mechanisms as well
  * bump requires-python due to dependencies requiring 3.9+
  * declare conflicting extras for uv
  * format pyproject.toml with Tombi
  
  fix(admin): update edit roles UI
  
  * Hide role IDs in the list role administration page
  * Restrict role edits to description changes only as
    Role name and ID are now unified.
  chore(migration): add request parent for commenting
  chore(migration): replace print with secho
  
  * for consistency reason, in a click script secho is used not print
  fix(admin): show clear error in View Changes modal on 403
  chore(setup): bump dependencies
  chore(git-blame): ignore the SPDX license header commit
  chore(licenses): update license headers to use SPDX
  chore(setup): bump dependencies
  refactor(views): Move get_record_requests to RecordCommunitiesService
  

  📁 invenio-assets (4.2.5 -> 4.2.6 🐛)

  release: v4.2.6
  fix: deprecation warning from less
  
  * Variable names beginning with a number are deprecated and will be
    removed in Less 5.x. Rename the variable to start with a valid
    identifier character
  
  * semantic-ui-less/themes/default/collections/menu.variables
    on line 444, column 9:
    <w> 444 @small: @13px;
  

  📁 invenio-audit-logs (4.0.1 -> 4.1.0 🌈)

  📦 release: v4.1.0
  feat: Configuration of service components
  
  * Added AUDIT_LOGS_SERVICE_COMPONENTS config option
  * Added run_components inside the `create` service method
  * Implemented test
  

  📁 invenio-banners (8.0.1 -> 8.0.2 🐛)

  release: v8.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-checks (11.0.1 -> 12.0.0 ⚠️)

  📦 release: v12.0.0
  refactor(checks): filter visible checks in template
  
  Add a Jinja global, get_visible_checks, to filter the checks and check
  classes that should be visible for a certain request. The filtering uses
  hide_parent_checks to define if certain checks should be filtered out
  based on the request's receiver community and the config's community.
  refactor(checks): extract severity icon logic
  
  Extract the severity icon logic for check tabs out of the template layer
  feat(checks): add hide_parent_checks to Check
  
  Add a class attribute on Check, hide_parent_checks, with default value
  False. This attribute is used in the UI, to filter out checks from the
  parent community when a check only needs to display check runs for the
  subcommunity. Otherwise, check class tabs and check runs from configs of
  the community and its parents are displayed (default behavior).
  feat(rules): allow skipping rules
  
  Adds a skipped attribute to RuleResult, which allows a rule to be
  ignored if its condition does not succeed.
  
  In the template, skipped rule results are not displayed.
  fix(checks): handle concurrent check runs across publish and edit
  
  Publish deletes the record run and turns the draft run into it with two ordered
  statements, without depending on any worker. `start_time` marks a worker's
  attempt and its result is stored only while the row still carries it, so a check
  still running at publish time lands on the published record, and an overtaken
  worker is ignored.
  
  `run_check` now seeds the draft run from the record run, replacing
  `copy_record_run_to_draft`. Two INSERT sites in one transaction is what left
  records uneditable.
  
  New runs are inserted in a savepoint, so losing the race against a concurrent
  save updates the winner's row instead of failing. The worker has time limits,
  and `cleanup_stale_check_runs` fails runs whose worker never came back.
  
  `is_draft` resolves to False for non-record targets, so the lookup is not
  `is_draft IS NULL`.
  fix(checks): implement CheckTargets registry
  refactor(checks): move skip-rerun logic into checks
  
  - Remove get_input_hash() from ChecksAPI.
  - Add should_rerun() to Check, which can be overwritten by the specific
  checks. They are responsible for their own skip-rerun logic via
  the previous_run's state
  - Pass kwargs to run() from run_check()
  - Update FileFormatsCheck and MetadataCheck to return (result, state)
  tuple
  - Use on_post_commit instead of on_commit on the AsncRunTaskOp
  fix(models): make `is_draft` NOT NULL and remove default for `target_type`
  fix(entrypoint): register invenio checks task
  fix(checks): refactored can rerun permission check to class
  fix(ui): handle async error status on checks ui
  fix(checks): improve async check execution reliability
  
  - Handle PENDING/RUNNING draft runs via _ConvertDraftToRecordCheckRunOp
  in publish() instead of unconditionally converting draft run into record
  run
  - Extract _CeleryTaskOp and _ConvertDraftToRecordCheckRunOp into a
  dedicated uow.py module to fix racing conditions
  - Add _should_skip_rerun to run_check, and refactor function
  - Let exceptions from check.run() propagate out of run_check so the
  Celery task retries and correctly marks runs as ERROR after max
  retries
  - Ensure Check Run status changes to Error after max tries, as before
  the the original exception was being re-raised and not reaching the
  block for max retries exceeded.
  fix(requests): pass community_id to get_runs
  
  Allows filtering check runs by community or parent community, so check
  runs for records with multiple inclusion requests are not shown accross
  the board.
  feat(checks): allowing reruning of checks based on flag
  refactor(checks): refactor async checks
  
  1. Explicitly pass is_draft to run_check when running an async check to
  ensure that no new run is created instead of fetching the existing run.
  
  2. Remove an unecessary guard based on whether the object has the
  is_draft attribute or not.
  
  3. Move task dispatch to _CeleryTaskOp.on_commit so Celery only receives
  the task after the full transaction commits and reads the correct most
  up-to-date metadata.
  
  4. Squash migrations
  feat(checks): refactored and integrated async checks workflow
  refactor(ui): display one icon per check type
  
  Before, we rendered one icon per CheckRun for a given check class. If
  there are more than one run with a certain check_id (for example, a
  check run for the parent community and another for the subcommunity,
  and both should apply), more than one icon was displayed.
  
  This commit aggregates to a single icon showing the worst severity
  across all runs for that check class.
  
  Also shortens name for severity icons, to be consistent with the changes
  made
  refactor(checks): pass kwargs to run checks
  refactor(checks): add sync and target_type
  feat(checks): add member check component
  feat(checks): add support for subcommunity checks
  release: v11.0.2
  fix(build): include mo files
  

  📁 invenio-collections (10.0.2 -> 10.0.3 🐛)

  release: v10.0.3
  fix(build): include mo files
  

  📁 invenio-communities (29.1.0 -> 29.1.1 🐛)

  release: v29.1.1
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-db (2.5.2 -> 2.6.0 🌈)

  release: v2.6.0
  fix(alembic): ignore the new "checkconstraint_byname" plugin for now
  
  * this new plugin causes a few hiccups like failures of alembic tests in
    our packages, so we disable it for now
  * in the future, we may consider looking into alternatives to this
    approach
  feat(tests): Comparing server defaults in alembic tests
  
  * Enriched test alembic context with a setting to compare
    server-side default values in migration state
  

  📁 invenio-drafts-resources (11.0.1 -> 11.0.2 🐛)

  release: v11.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-files-rest (6.0.1 -> 6.1.0 🌈)

  release: v6.1.0
  fix(build): include mo files
  fix(ci): run tests on maint-*
  helpers: add no_cache cache-control for restricted files
  
  Added comments regarding cache-control settings and Flask configuration.
  

  📁 invenio-formatter (5.0.1 -> 5.0.2 🐛)

  release: v5.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-github (7.1.1 -> 7.1.2 🐛)

  release: v7.1.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-i18n (4.0.1 -> 4.0.2 🐛)

  release: v4.0.2
  fix(i18n): include *.mo files in distribution
  
  * The *.mo files are necessary for translation, but are included
  in `.gitignore` which causes hatchling to skip them by default
  * they get added by the `pybabel compile` step on release
  

  📁 invenio-jobs (11.0.1 -> 11.0.3 🐛)

  release: v11.0.3
  fix: subtasks_closed db-side default
  
  * alembic migrations include db-side default
    for the subtasks_closed. It was decided that
    using db-defaults is the way to go - so
    server-side default was added to the model as
    well
  release: v11.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-notifications (2.0.1 -> 2.0.2 🐛)

  release: v2.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-oaiserver (6.0.1 -> 6.0.2 🐛)

  release: v6.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-oauth2server (6.0.1 -> 6.0.2 🐛)

  release: v6.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-pages (10.0.2 -> 10.0.3 🐛)

  release: v10.0.3
  fix(build): include mo files
  fix(ci): run tests on maint-*
  fix(tests): create `Page` fixtures one by one to space out creation
  
  * some tests are sorting pages by their creation timestamp
  * these tests become flaky when several `Page` models have the same
    creation timestamp
  

  📁 invenio-pidstore (4.0.1 -> 4.0.2 🐛)

  release: v4.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-rdm-records (33.3.0 -> 35.0.0 ⚠️)

  📦 release: v35.0.0
  chore(deps): bump invenio-checks to v12.x
  fix(checks): Define CheckTarget for record
  fix(checks): explicitly add target_type
  📦 release: v34.1.0
  fix(files): extract metadata after draft publication
  fix(file-modification): handle validation errors
  
  When clicking "Enable file editing", the modal would freeze in a loading
  state if the draft had any validation errors or warnings. `saveAction`
  threw on validation issues but the call was outside the
  try/catch/finally, so loading was never reset.
  
  Now, saveAction is covered by try/catch, with blocking errors surfacing
  an error message in the modal, while warning errors are non-blocking and
  the file modification request proceeds. This behavior is consistent with
  the publish and preview flows.
  release: v34.0.1
  feat(quota): implement policy evaluation for allowing users
  
  - refactor the request policy evaluators to enable the evaluation if a
    user is allowed only, before evaluating the policies themselves
  - allow controlling if a feature is enabled or not depending on the
    logged in user
  fix(quota): don't cast record id to int
  
  * The topic record id is a PID value, which is a string for any instance
    using the default alphanumeric provider. Only repositories that mint
    numeric recids (e.g. Zenodo) could accept a quota increase request.
  fix(deposit-ui): enforce file count and storage quotas in Uppy uploader
  
  * Add createFileValidator to reject files exceeding maxFiles/maxStorage
  * Enforce maxFileSize quota in validator and Uppy restrictions
  * Show SUI Dimmer overlay when file count or storage quota is reached
  * Avoid Uppy disabled race condition with Dimmer overlay
  * Keep failed files in Uppy for retry/remove after upload
  
  fix(uppy): keep failed uploads in dashboard on complete
  fix(build): include mo files
  bump commonmeta version
  add test
  fix: add IsVersionOf relations to concept doi in crossref serializer
  mappings: disable draft geometry doc values
  fix(awards): drop organizations from funding award relation
  fix(creatibutors): only accept txt files
  release: v34.0.0
  fix(CreatibutorsFieldItem): Trigger update via context
  
  * A field Item is only updated when the Formik data changes and not for any UI changes to do away with unnecessary re-draws, the Item is in charge of handling it's highlighting when it's first added to the UI
  fix(CreatibutorsInlinePanel): Move props to CreatibutorsItemContext
  fix(CreatibutorsFileModal): Simplify components and CSS rendering
  fix(CreatibutorsInlinePanel): Optimize re-render condition
  
  * Decrease searchbar width to 50%
  * Reuse pre-existing CSS classes
  feat(Creatibutors): add inline scrolling and file importing in deposit
  
  * When the author or contributor count exceeds RDM_CREATIBUTORS_INLINE_LIST_THRESHOLD, the deposit form shows an inline panel with search and becomes scrollable.
  * Large lists are rendered in batches of RDM_CREATIBUTORS_RENDER_BATCH_SIZE to keep the UI responsive.
  * Added FileImportReviewModal with JSON parsing (RDM API format)
  fix: fixed isParentAlreadyPublished not working on /new
  fix(alembic): alter index safely
  
  * the problem is that some of those drop create index statements try to
    fix model changes which exists for to long now. if version v20.x is
    used to create an instance the indices which should be droped are not
    created and the to create indices exists already.
  

  📁 invenio-records-resources (11.0.0 -> 11.0.3 🐛)

  📦 release: v11.0.3
  fix(files): retry metadata extraction after publication
  release: v11.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  release: v11.0.1
  fix: retry multipart checksum computation
  
  * Retry checksum computation on transient errors, such as network
    failures or container restarts.
  * Use exponential backoff to allow the network or S3 service time
    to recover.
  chore(setup): migrate from setuptools to hatchling
  
  * remove MANIFEST.in because that's only relevant for setuptools
  * translate the i18n/translation mechanisms as well
  * bump requires-python due to dependencies requiring 3.9+
  * declare conflicting extras for uv
  * format pyproject.toml with Tombi
  
  chore(cleanup): remove outdated and unnecessary files
  fix(performance): replace deepcopy with shallow copy for link expansion
  
  * deepcopy has been identified as a costly operation, and we generally
    don't perform modifications on context anyway
  chore(git-blame): ignore the SPDX license header commit
  chore(licenses): update license headers to use SPDX
  

  📁 invenio-records-rest (6.0.1 -> 6.0.2 🐛)

  release: v6.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  fix(views): accept weak ETags in If-Match for nginx+gzip compatibility
  
  ETags in invenio are version counters (record.revision_id), not content
  hashes. When nginx compresses responses it downgrades strong ETags ("N")
  to weak ones (W/"N") because gzip changes the byte sequence. Clients
  that round-trip the received ETag in If-Match were getting a silent 412
  or, worse, a bypassed precondition check.
  
  Pass weak=True to check_etag in all four handlers (delete, get, patch,
  put) so that both W/"N" and "N" are accepted. This is correct because
  the strong/weak distinction is only meaningful for content-derived ETags;
  a version counter identifies resource state unambiguously regardless of
  transfer encoding.
  
  fix(views): pass_record swallows StaleDataError as PIDResolveRESTError
  
  The return f(...) call inside pass_record's try/except SQLAlchemyError
  caused any database error raised by the handler (e.g. StaleDataError on
  optimistic-locking conflict) to be silently re-raised as PIDResolveRESTError
  (500) instead of propagating correctly.
  
  * Move return f(...) outside the try block in pass_record so the except
    only covers PID resolution.
  * Add a dedicated RecordConflictRESTError (409) and raise it from put() on
    StaleDataError (with rollback) instead of a bare abort(409).
  * Add tests for the stale-data 409 path and for pass_record no longer
    swallowing handler-level SQLAlchemy errors.
  * Update test_delete_with_sqldatabase_error to reflect that SQLAlchemy
    errors from handlers now propagate unhandled instead of being masked.
  

  📁 invenio-records-ui (5.0.1 -> 5.0.2 🐛)

  release: v5.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-requests (15.1.1 -> 15.2.0 🌈)

  release: v15.2.0
  fix(timeline): avoid throwing error on request abort during auto refresh
  fix(build): include mo files
  fix(ci): run tests on maint-*
  config: add config flag for timeline refresh interval
  fix(comments): resolve collisions in allowed tags configuration
  
  * the `dict()` function cannot handle receiving multiple values for a
    keyword argument with the same name; it will raise a `TypeError`
  * the dictionary literal (`{**d1, **d2}`) does support multiple values
    for the same key however, with the latest value overriding earlier
    values
  * this seems to be the semantic that we want here, to have the more
    specific configuration `REQUESTS_COMMENTS_ALLOWED_EXTRA_HTML_ATTRS`
    take precendence over the more general `ALLOWED_HTML_ATTRS`
  

  📁 invenio-search-ui (5.0.2 -> 5.0.3 🐛)

  release: v5.0.3
  fix(build): include mo files
  

  📁 invenio-stats (7.0.1 -> 7.0.2 🐛)

  release: v7.0.2
  fix(build): include mo files
  

  📁 invenio-theme (5.0.2 -> 5.0.3 🐛)

  release: v5.0.3
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-userprofiles (7.0.1 -> 7.0.2 🐛)

  release: v7.0.2
  fix(build): include mo files
  fix(ci): run tests on maint-*
  

  📁 invenio-users-resources (13.1.0 -> 13.1.1 🐛)

  release: v13.1.1
  fix(build): include mo files
  

  📁 invenio-vocabularies (14.2.1 -> 14.3.1 🌈)

  📦 release: v14.3.1
  📦 release: v14.3.0
  feat(awards): add website field populated from CORDIS
  
  * Awards had nowhere to record a project's own website. The
    `identifiers` list cannot hold one, since only a single identifier per
    scheme is allowed and `url` should be used for the CORDIS project link.
  fix(contrib): display all funders api search results
  
    * without the search prop, semantic-ui does extra filtering
      on the API hits, thus neglecting the already in place backend
      search filters
    * re-add the search prop with a twist - force recomputation of
      the options array because otherwise the options list will be
      polluted with "Add " options (again added by the semantic-ui
      component from allowAdditions)
    * the end result is displaying only one Add option + all the API
      search hits
  

  📁 invenio-webhooks (4.0.1 -> 4.0.2 🐛)

  release: v4.0.2
  fix(i18n): include *.mo files in distribution
  
  * The *.mo files are necessary for translation, but are included
  in `.gitignore` which causes hatchling to skip them by default
  * they get added by the `pybabel compile` step on release
  

  🚨 Major version bumps (potentially breaking changes):
  📁 setuptools (83.0.0 -> 84.0.0 ⚠️)

• release: v25.2.4