Automate Dependabot vendor refreshes

[bifrost0x]

What changed

• add a privileged workflow_run that refreshes committed frontend vendor assets only for validated npm Dependabot PRs whose existing vendor check failed
• validate the workflow run, bot identity, repository, branch, PR head SHA, base branch, changed files, and failed CI step before any write
• install npm dependencies with lifecycle scripts disabled and execute only trusted scripts from the default branch
• stage and commit only static/vendor/**, then dispatch the normal test workflow for the exact generated commit SHA
• add behavioral and supply-chain regression tests for the validation and Git staging boundaries

Why

Dependabot can update package.json and package-lock.json, but it cannot regenerate the frontend files committed under static/vendor/. The existing vendor:check correctly rejects those stale assets, leaving otherwise valid npm update PRs red.

The follow-up workflow keeps the write token separate from untrusted PR execution and gives Dependabot PRs a deterministic path back to the normal test suite.

Validation

• pytest tests -q - 1326 passed, 33 skipped
• npm run test:js - 73 passed
• npm run vendor:check - 10 assets verified
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 50504a1ce5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Clean the generated manifests before checking out the PR

For every npm update where package.json or package-lock.json differs from the default branch, the earlier fetch step overwrites those tracked files in the current checkout, so this unforced checkout aborts with Your local changes ... would be overwritten by checkout even though the working-tree contents match FETCH_HEAD; consequently the workflow never reaches the vendor commit. As confirmed by git checkout -h, --force is the option that will “throw away local modifications,” so reset/clean the generation checkout or perform the PR checkout in a separate clean worktree.

Useful? React with 👍 / 👎.