Rebuild comment sync as a post-merge repair caller

[jeremy]

Replaces the in-PR workflow_run caller with the post-merge model (basecamp/.github#11, pinned 45d3fc95): any non-Dependabot push to a Dependabot branch flips the retriggered runs' actor off dependabot[bot], lifting the Dependabot sandbox for the PR's unreviewed action bumps — verified live on #566. Post-merge, the reusable workflow repairs drifted comments via a comment-only auto-merging PR; every pin it touches is already reviewed, and nothing is ever pushed to a Dependabot branch. Dependabot maintains the bare comments on its own PRs after the bare-pin restructure (Layer 1, merged fleet-wide).

The workflow entry stays disabled through this merge; repos are enabled one at a time after a full-cycle exercise (seeded drift → repair PR → held-run approval → CI → auto-merge → terminal no-op) in one repo.

---

Summary by cubic

Rebuilds Dependabot action pin comment sync to run post-merge on workflow-file changes, opening a comment-only repair PR that auto-merges after checks. Removes the in-PR workflow_run path to avoid actor flips that bypass the Dependabot sandbox; only reviewed default-branch code runs.

• Refactors
  • Switch trigger to push on main for .github/workflows/*.{yml,yaml} and keep workflow_dispatch.
  • Call the reusable workflow in basecamp/.github as a post-merge backstop; Dependabot maintains comments on its own PRs.
  • Open comment-only repair PRs; never push to Dependabot branches.
  • Update permissions to pull-requests: write; leave the workflow disabled for staged, per-repo rollout.

^{Written for commit 393ae01. Summary will update on new commits.}

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/dependabot-sync-actions-comments.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

Pull request overview

This PR refactors the Dependabot action pin comment sync workflow to run post-merge (on main workflow-file pushes) via a SHA-pinned reusable workflow in basecamp/.github, instead of running in-PR via workflow_run on Dependabot branches.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Changes:

• Replace the workflow_run trigger on Dependabot branches with a push trigger on main limited to .github/workflows/*.yml|*.yaml, keeping workflow_dispatch.
• Update the reusable workflow reference to basecamp/.github pinned at 45d3fc9588f15d50fbccde7476418007dd19e16e.
• Adjust job permissions to allow pull-requests: write for opening/maintaining repair PRs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>