Sync Dependabot action pin comments via reusable workflow

[jeremy]

Thin caller for the dependabot-sync-actions-comments reusable workflow (basecamp/.github#8, merged as 95a9f7a2). After CI completes on a Dependabot github_actions branch, trusted default-branch code fixes any stale # vX.Y.Z pin comments — including compound ones with trailing # zizmor: ignore[...] annotations that Dependabot can't rewrite — and pushes back behind a compare-and-swap lease.

Security model (openclaw-basecamp lineage, hardened after basecamp-sdk#458 review): the Dependabot head branch is fetched as data and never executed; the push uses a write deploy key scoped to this repo's dependabot-sync environment, whose deployment branch policy allows only the default branch (App tokens can't push workflow-file changes at all). Environment + deploy key are already provisioned.

Second commit is a one-time catch-up running the updater against current workflows: 3 stale comments in release.yml (setup-go v6.4.0→v6.5.0 ×2, cache v5.0.5→v6.1.0).

Runtime validation: after merge, a workflow_dispatch run against a live Dependabot actions branch (basecamp-cli#566 is the standing candidate) proves the full fix→guard→push→re-CI loop.

---

Summary by cubic

Adds a workflow to auto-sync Dependabot Actions pin comments after CI, keeping # vX.Y.Z hints accurate without running untrusted code. Also updates stale comment versions in release.yml (actions/setup-go → v6.5.0; actions/cache → v6.1.0).

• New Features
  • Adds .github/workflows/dependabot-sync-actions-comments.yml, a thin caller for the SHA-pinned reusable workflow in basecamp/.github.
  • Triggers on workflow_run of Test for dependabot/github_actions/** only, plus manual workflow_dispatch (branch, e2e inputs); keeps a job-level if as defense-in-depth.
  • Rewrites stale pin comments, including lines with trailing # zizmor: ignore[...], on Dependabot action PR branches.
  • Security: fetches the Dependabot branch as data only; pushes via a deploy key scoped to the dependabot-sync environment with minimal permissions and secrets: inherit.

^{Written for commit 4238cf9. Summary will update on new commits.}

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/dependabot-sync-actions-comments.yml
• .github/workflows/release.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

Pull request overview

Adds a repository workflow that delegates to the basecamp/.github reusable workflow to keep Dependabot github_actions PR branches’ # vX.Y.Z pin comments in sync, plus a one-time catch-up of stale pin comment versions in the release workflow.

Changes:

• Add .github/workflows/dependabot-sync-actions-comments.yml as a thin caller for the SHA-pinned reusable workflow that performs the sync/push behind a CAS lease.
• Update actions/setup-go and actions/cache pin comments in release.yml to match the already-pinned SHAs.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/dependabot-sync-actions-comments.yml	New workflow entrypoint that triggers on workflow_run / workflow_dispatch and delegates to the pinned reusable workflow.
.github/workflows/release.yml	One-time catch-up updating stale # vX.Y.Z pin comments to match existing pinned SHAs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.