Rebuild comment sync as a post-merge repair caller

[jeremy]

Replaces the in-PR workflow_run caller with the post-merge model (basecamp/.github#11, pinned 45d3fc95): any non-Dependabot push to a Dependabot branch flips the retriggered runs' actor off dependabot[bot], lifting the Dependabot sandbox for the PR's unreviewed action bumps — verified live on basecamp/basecamp-cli#566. Post-merge, the reusable workflow repairs drifted comments via a comment-only auto-merging PR; every pin it touches is already reviewed, and nothing is ever pushed to a Dependabot branch. Dependabot maintains the bare comments on its own PRs after the bare-pin restructure (Layer 1, merged fleet-wide).

The workflow entry stays disabled through this merge; repos are enabled one at a time after a full-cycle exercise (seeded drift → repair PR → held-run approval → CI → auto-merge → terminal no-op) in one repo.

---

Summary by cubic

Rebuilt the Dependabot action-pin comment sync to run post-merge as a repair step. This avoids touching Dependabot branches, keeps the sandbox intact, and fixes drift via small, auto-merging repair PRs.

• Refactors

  • Replace in-PR workflow_run with push on master (scoped to .github/workflows/*.yml|yaml) and keep workflow_dispatch.
  • Remove branch/E2E inputs; pass only default-branch.
  • Grant pull-requests: write so the reusable workflow can open comment-only repair PRs.
  • All execution is reviewed default-branch code; nothing pushes to Dependabot branches.

• Migration

  • Workflow stays disabled after merge; enable per repo after a full-cycle exercise (seeded drift → repair PR → approval → CI → auto-merge → no-op).

^{Written for commit 5b390fa. Summary will update on new commits.}

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/dependabot-sync-actions-comments.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

Pull request overview

This PR updates the repository’s Dependabot action-pin comment sync workflow to run post-merge (on master workflow-file pushes) via a SHA-pinned reusable workflow in basecamp/.github, so drifted pin comments are repaired through a small, comment-only PR rather than by interacting with Dependabot branches.

Changes:

• Replace the in-PR workflow_run trigger with a post-merge push trigger on master scoped to .github/workflows/*.yml|*.yaml, while keeping workflow_dispatch.
• Simplify the reusable-workflow inputs to only pass default-branch.
• Expand job permissions to allow opening repair PRs (pull-requests: write) while continuing to use secrets: inherit for the deploy key.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>