Seed a stale pin comment for the sync rollout exercise

[jeremy]

Rollout exercise for the post-merge comment-sync (basecamp/.github#11, caller #462): deliberately mislabels the setup-go pin comment (# v7.0.0 → # v6.9.9; the SHA is untouched and correct). After this merges, the sync workflow gets enabled in this repo only and dispatched — the expected outcome is a bot repair PR restoring exactly this comment, auto-merging once checks pass, followed by a terminal no-op run. Full-cycle proof before enabling the fleet.

---

Summary by cubic

Seeds a stale version comment on the pinned actions/setup-go step in .github/workflows/release-go.yml by changing # v7.0.0 to # v6.9.9 (SHA unchanged). This intentionally triggers the post-merge comment-sync workflow to open a repair PR that restores the comment and then no-ops.

^{Written for commit 9845ca6. Summary will update on new commits.}

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/release-go.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

Pull request overview

Seeds intentional “pin comment drift” in the Go release workflow to exercise the post-merge comment-sync repair workflow (expected to trigger a bot repair PR that restores the correct version comment while keeping the SHA pinned).

Changes:

• Change the actions/setup-go pin comment in .github/workflows/release-go.yml from # v7.0.0 to # v6.9.9 (SHA unchanged) to deliberately create stale metadata.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[jeremy]

The GitHub Actions audit failing here is the expected first proof point: zizmor catches bare-comment drift at regular persona (the Layer-1 tripwire). Admin-merging as the documented exercise step; the repair PR should restore the comment and turn main's audit green again.