Rebuild comment sync as a post-merge repair caller

[jeremy]

Replaces the in-PR workflow_run caller with the post-merge model (basecamp/.github#11, pinned 45d3fc95): any non-Dependabot push to a Dependabot branch flips the retriggered runs' actor off dependabot[bot], lifting the Dependabot sandbox for the PR's unreviewed action bumps — verified live on basecamp/basecamp-cli#566. Post-merge, the reusable workflow repairs drifted comments via a comment-only auto-merging PR; every pin it touches is already reviewed, and nothing is ever pushed to a Dependabot branch. Dependabot maintains the bare comments on its own PRs (this repo has been bare-pin since #458).

The workflow entry stays disabled through this merge; this repo hosts the full-cycle exercise (seeded drift → repair PR → held-run approval → CI → auto-merge → terminal no-op) before fleet enablement. Siblings: basecamp-cli#577, hey-cli#143, fizzy-cli#195, cli#54, openclaw-basecamp#158.

---

Summary by cubic

Switch the Dependabot Actions pin comment sync to a post-merge repair flow. It now runs on workflow-file pushes to main and fixes drift via a comment-only repair PR that auto-merges after checks, keeping the Dependabot sandbox intact.

• Refactors
  • Replace in-PR workflow_run with push-to-main trigger for .github/workflows/*.{yml,yaml}; keep workflow_dispatch (no inputs).
  • Use the reusable workflow from basecamp/.github to recompute pins and open repair PRs; no pushes to Dependabot branches, only reviewed default-branch code runs.
  • Permissions: pull-requests raised to write; contents read; actions write.
  • Left disabled here to run a full-cycle exercise before enabling broadly.

^{Written for commit 9af6f60. Summary will update on new commits.}

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/dependabot-sync-actions-comments.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

Pull request overview

This PR updates the Dependabot action pin comment sync automation to the post-merge “repair PR” model by switching the caller workflow to invoke the SHA-pinned reusable workflow from basecamp/.github, intended to recompute # vX.Y.Z comments after workflow changes land on the default branch.

Changes:

• Replace the previous in-PR workflow_run trigger model with a default-branch push trigger filtered to .github/workflows/*.yml and .yaml.
• Update the caller to use the new reusable workflow pin (45d3fc95…) and adjust job permissions (pull-requests: write).
• Keep secrets: inherit for passing the environment-scoped deploy key through to the reusable workflow.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}