Sync Dependabot action pin comments via reusable workflow

[jeremy]

Thin caller for the dependabot-sync-actions-comments reusable workflow (basecamp/.github#8, merged as 95a9f7a2). After CI completes on a Dependabot github_actions branch, trusted default-branch code fixes any stale # vX.Y.Z pin comments — including compound ones with trailing # zizmor: ignore[...] annotations that Dependabot can't rewrite — and pushes back behind a compare-and-swap lease.

Security model (openclaw-basecamp lineage, hardened after basecamp-sdk#458 review): the Dependabot head branch is fetched as data and never executed; the push uses a write deploy key scoped to this repo's dependabot-sync environment, whose deployment branch policy allows only the default branch (App tokens can't push workflow-file changes at all). Environment + deploy key are already provisioned.

Two catch-up commits clear latent failures this PR's CI surfaced (the repo has been dormant, and both gates depend on external state that moved since CI last ran):

• seed workflow pin comments — ref-version-mismatch is an online audit; upstream tag moves left 33 stale version comments in seed/.github/workflows/. Fixed via zizmor --fix=all, with the two # zizmor: ignore[cache-poisoning] annotations its fixer clobbers restored by hand. Seed templates stay manually maintained; the sync workflow covers only .github/workflows/.
• golang.org/x/sys v0.27.0 → v0.44.0 — clears CVE-2026-39824 flagged by the Trivy gate (indirect dep; go build ./... verified).

Runtime validation: after merge, a workflow_dispatch run against a live Dependabot actions branch (basecamp-cli#566 is the standing candidate for the fleet) proves the full fix→guard→push→re-CI loop.

Sibling callers: basecamp-sdk#459, basecamp-cli#572, hey-cli#141, fizzy-cli#189.

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/dependabot-sync-actions-comments.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

Pull request overview

Adds a thin GitHub Actions workflow in this repo to call the SHA-pinned basecamp/.github reusable workflow that syncs stale Dependabot action pin comments after CI completes (and supports a manual workflow_dispatch path).

Changes:

• Introduce dependabot-sync-actions-comments workflow triggered via workflow_run on Test and via workflow_dispatch.
• Gate execution to Dependabot dependabot/github_actions/* branches and delegate all logic to the reusable workflow pinned at 95a9f7a2….
• Apply least-privilege defaults (permissions: {}) with scoped job permissions and secrets: inherit to allow the environment-scoped deploy key to flow to the called workflow.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

.github/workflows/dependabot-sync-actions-comments.yml:13

• The job-level if: doesn’t prevent this workflow from being triggered on every Test completion; it will still create a skipped workflow run for non-Dependabot branches. If the goal is to avoid noisy skipped runs, add a branches: filter under on.workflow_run so the workflow isn’t triggered at all for other branches (you can keep the job if as a safety net for workflow_dispatch).

on:
  workflow_run: # zizmor: ignore[dangerous-triggers] -- only the SHA-pinned reusable workflow (reviewed default-branch code) executes; the Dependabot head branch is fetched as data, never executed
    workflows: [Test]
    types: [completed]
  workflow_dispatch:

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/dependabot-sync-actions-comments.yml:40

• ${{ inputs.* }} context is only available for workflow_dispatch/workflow_call. Because this workflow is primarily triggered by workflow_run, these expressions will error with Unrecognized named-value: 'inputs' when the workflow_run path executes, preventing the sync job from running.

      branch: ${{ inputs.branch || '' }}
      e2e: ${{ inputs.e2e || false }}