Rebuild comment sync as a post-merge repair caller - #143
Conversation
Replaces the in-PR workflow_run caller: any non-Dependabot push to a Dependabot branch flips the retriggered runs' actor off dependabot[bot], lifting the Dependabot sandbox for the PR's unreviewed action bumps (verified live on basecamp-cli#566; see basecamp/.github#11). The reusable workflow now runs post-merge: on workflow-file pushes to the default branch it repairs drifted comments via a comment-only auto-merging PR — only reviewed code ever executes. Dependabot itself maintains the bare comments on its own PRs after the bare-pin restructure. Lands disabled; enabled per repo after a full-cycle exercise.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s Dependabot action-pin comment sync workflow to use the post-merge “repair PR” model by invoking a SHA-pinned reusable workflow from basecamp/.github, aligning with the fleet-wide shift away from workflow_run triggers on Dependabot branches.
Changes:
- Replace the
workflow_runtrigger (Dependabot branch runs) with apush-to-maintrigger scoped to workflow file changes. - Switch the reusable workflow pin to
45d3fc9588f15d50fbccde7476418007dd19e16eand simplify the caller interface. - Adjust job token permissions to allow the reusable workflow to open/update repair PRs (
pull-requests: write).
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 1 file
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Replaces the in-PR
workflow_runcaller with the post-merge model (basecamp/.github#11, pinned 45d3fc95): any non-Dependabot push to a Dependabot branch flips the retriggered runs' actor offdependabot[bot], lifting the Dependabot sandbox for the PR's unreviewed action bumps — verified live on basecamp/basecamp-cli#566. Post-merge, the reusable workflow repairs drifted comments via a comment-only auto-merging PR; every pin it touches is already reviewed, and nothing is ever pushed to a Dependabot branch. Dependabot maintains the bare comments on its own PRs after the bare-pin restructure (Layer 1, merged fleet-wide).The workflow entry stays disabled through this merge; repos are enabled one at a time after a full-cycle exercise (seeded drift → repair PR → held-run approval → CI → auto-merge → terminal no-op) in one repo.
Summary by cubic
Rebuilt Dependabot action pin comment sync to run post-merge on workflow-file changes, opening a comment-only repair PR instead of touching Dependabot branches. This keeps the Dependabot sandbox intact and ensures only reviewed default-branch code runs.
pushtomainfor workflow file changes;workflow_dispatchremains available.basecamp/.github, pinned to a reviewed revision.# vX.Y.Zcomments via an auto-merging, comment-only PR; never pushes to Dependabot branches.pull-requests: write; workflow stays disabled and will be enabled per repo after a full-cycle test.Written for commit 7c758c8. Summary will update on new commits.