Rebuild comment sync as a post-merge repair workflow

[jeremy]

Third and structural revision of the sync model, following the confirmed P1 on the in-PR design: any non-Dependabot push to a Dependabot branch — deploy key included — flips the actor of the retriggered pull_request runs off dependabot[bot], lifting GitHub's Dependabot sandbox (read-only token, no Actions secrets) for the PR's freshly bumped, unreviewed action pins. Verified live on basecamp/basecamp-cli#566: runs on the original head were actored dependabot[bot]; runs on the synced head were actored jeremy. Removing the dispatch fallback (#10) was necessary but insufficient.

New model

• Layer 1 (no automation): repos are restructured to one-line pins with standalone zizmor ignores (basecamp-cli#576, hey-cli#142, fizzy-cli#192, cli#53, openclaw-basecamp#157), so Dependabot rewrites the bare # vX.Y.Z comments natively on its own PRs.
• Layer 2 (this workflow): post-merge backstop. On workflow-file pushes to the default branch, recompute comments; when drifted, push a comment-only repair branch with the environment-scoped deploy key and open a PR that auto-merges once required checks pass. Every pin the repair touches is already reviewed — its CI executes exactly the action SHAs already on the default branch, so there is no sandbox to escape and no actor that matters.

Successor-commit invariants (checked before pushing, re-checked before arming auto-merge)

• Repair commit's parent == the captured base SHA (committed on the detached base checkout, asserted anyway)
• uses: action-path@sha tuple sets byte-identical between base and repair (only comment tokens may move); staged-diff line guard + the updater's own per-line assertion
• Exactly one bot-owned repair branch/PR (bot/sync-action-pin-comments), bot-authored, based on the default branch — anything else errors without touching it
• --force-with-lease pinned to the just-observed remote SHA (empty = must-not-exist); job-level concurrency serializes runs
• Held-run approval scoped to the exact repair head (GITHUB_TOKEN-created PRs start held); repair merge's own push triggers the terminal no-op run

Also in this PR

• Updater accepts SemVer build-metadata tags (v1.2.3+build.1) with regression tests (23 total) — closes the fail-closed-forever case from the earlier review
• node --test glob unquoted so the shell expands it on any Node

Caller contract changed (push-to-default trigger, pull-requests: write, repo setting "Allow GitHub Actions to create and approve pull requests"); caller PRs follow, landing while the workflows remain disabled, with a full-cycle exercise in one repo before enabling the fleet one at a time.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a7009f7e2d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR restructures the Dependabot action-pin comment syncing model to avoid Dependabot sandbox escapes by moving synchronization to a post-merge “repair PR” workflow on default-branch workflow-file changes, and extends the tag parser to accept SemVer build metadata in version comments.

Changes:

• Rebuilds the reusable workflow to run only on the default branch, compute drift, push a comment-only repair branch, open a repair PR, and arm auto-merge.
• Extends tag parsing/selection to accept vX.Y.Z+build.meta build-metadata tags (while ignoring metadata for precedence) with new tests.
• Updates CI to run node --test with an unquoted glob so the shell expands it reliably.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/dependabot-sync-actions-comments.yml	Replaces in-PR syncing with a post-merge repair-PR workflow, adds safety invariants, and auto-merge/held-run handling.
scripts/sync-action-pin-comments.mjs	Accepts SemVer build metadata in eligible version tags and ignores metadata for precedence.
scripts/sync-action-pin-comments.test.mjs	Adds regression coverage for build-metadata tag indexing and repair behavior.
.github/workflows/ci.yml	Adjusts Node test invocation so the shell expands the test glob consistently.

Comments suppressed due to low confidence (1)

.github/workflows/dependabot-sync-actions-comments.yml:590

• Same author-login issue as above: the post-create verification requires author == "github-actions", but the PR author for GITHUB_TOKEN-created PRs is "github-actions[bot]". This will prevent auto-merge from being armed.

          oid="$(jq -r '.[0].headRefOid' <<<"$prs")"
          base="$(jq -r '.[0].baseRefName' <<<"$prs")"
          author="$(jq -r '.[0].author.login' <<<"$prs")"
          num="$(jq -r '.[0].number' <<<"$prs")"
          if [ "$oid" != "$NEW_HEAD" ] || [ "$base" != "$BASE_BRANCH" ] || [ "$author" != "github-actions" ]; then
            echo "::error::repair PR does not match the proven commit (head=${oid}, base=${base}, author=${author}); not arming auto-merge"
            exit 1

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.