Refresh the Nix vendorHash on Dependabot Go bumps

[jeremy]

Stacked on basecamp/.github#19 and pinned to its branch SHA; re-pin to the merged SHA once that lands.

Every Dependabot Go bump here arrives red on "Nix flake builds": go.sum moves, the vendorHash in nix/package.nix does not, and because that check is required the PR wedges until someone runs make update-nix-hash with Docker — #427 is sitting there now. This thin caller runs the reusable workflow on Dependabot PRs that touch go.mod/go.sum: it builds the flake at the PR's merge commit, takes the corrected hash from Nix's go-modules fixed-output mismatch, and commits exactly that one line of nix/package.nix back to the PR with a one-hour cli-release-bot token scoped to this repository. That push re-triggers the PR's own CI, whose Nix check verifies the new hash; the re-triggered run is actored by the App bot, so the Dependabot actor guard ends the loop. Auto-merge, already armed by dependabot-auto-merge.yml, then proceeds unattended.

Why pushing into a Dependabot PR is sound here when it was abandoned for actions bumps (basecamp/.github#11): the workflow code that re-runs after the push is main's, and I audited every pull_request job in this repo — none references a secret outside the actor-gated auto-merge job, so the actor flip exposes nothing to the bumped dependency code that go test does not already run under Dependabot's sandbox. The reusable workflow's header carries the full reasoning; this file's header states the invariant to keep.

What has to be in place, and verification

Live verification is not possible from this branch: workflow_dispatch resolves workflows registered from the default branch only (a dispatch from here was refused with a 404), and no path other than dispatch or a Dependabot push can reach the job. A probe run on this branch did settle the credential question: vars.RELEASE_CLIENT_ID is empty outside release.yml, because both it and RELEASE_APP_PRIVATE_KEY live in the release environment and are unreachable from any other job — so the client id is passed as a literal here (it is a public identifier, printed in every release run), and the private key needs a copy outside that environment.

Before the Dependabot-triggered path works here:

1. Install the cli-release-bot App on this repository with contents: write (I cannot see its installation list; the release jobs only ever mint for homebrew-tap and skills).
2. Add its private key as a repository Dependabot secret RELEASE_APP_PRIVATE_KEY — Dependabot-triggered runs see only Dependabot secrets. basecamp-cli already has this one; hey-cli has none.
3. Optionally, the same key as a repository Actions secret of the same name, which is what the workflow_dispatch path reads.

Then, with basecamp/.github#19 and this merged: comment @dependabot rebase on #427 (or dispatch this workflow with pr=427). The run computes the hash at #427's merge commit (its failing job reported sha256-ru1Q0ytS0Gq2f9JHovoPZYU9OejoVqtwsyNs1HnQ6TA= against the pre-Go-1.27 main this morning; the value may differ now that main builds with Go 1.27, which is exactly why it is computed at the merge and verified by the PR's own check rather than copied), pushes the one-line commit, and #427's "Nix flake builds" re-runs green; auto-merge, already armed on #427, then lands it.

actionlint 1.7.12 and zizmor 1.30.0 are clean; the bot-conditions ignore carries the same dual-check reasoning as dependabot-auto-merge.yml. No required check changes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T21:52:57.986289Z	1d1ecc6	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/dependabot-sync-nix-vendor-hash.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

🔵 Needs a closer look

Credentialed PR writes depend on an unmerged reusable workflow and repository App/secret configuration outside this diff.

Pull request overview

Adds automation to refresh stale Nix vendorHash values on Dependabot Go dependency PRs.

Changes:

• Triggers on Dependabot changes to go.mod or go.sum.
• Calls the SHA-pinned reusable workflow with scoped permissions and App credentials.
• Supports manual refresh by PR number.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File summaries

File	Description
.github/workflows/dependabot-sync-nix-vendor-hash.yml	Defines the automatic and manual Nix hash refresh caller.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jeremy]

On Copilot's note that the credentialed write depends on an unmerged reusable workflow and on App/secret configuration outside this diff — yes, by design, and here is the order it lands in:

1. Refresh the Nix vendorHash on Dependabot Go bumps .github#19 merges; this caller is pinned to its head (49eaa215) and gets re-pinned to the merged SHA before this merges.
2. Install the cli-release-bot App on this repository with contents: write.
3. Add its private key as a repository Dependabot secret RELEASE_APP_PRIVATE_KEY (Dependabot-triggered runs see only Dependabot secrets; the copy release.yml uses is scoped to the release environment and unreachable here) and, if the manual workflow_dispatch path is wanted, as a repository Actions secret of the same name.
4. Merge this. Then @dependabot rebase on deps: bump google.golang.org/grpc from 1.83.1 to 1.83.2 in the go_modules group across 1 directory #427 (or dispatch with pr=427) exercises it: the run computes the hash at deps: bump google.golang.org/grpc from 1.83.1 to 1.83.2 in the go_modules group across 1 directory #427's merge commit, pushes the one-line commit, and deps: bump google.golang.org/grpc from 1.83.1 to 1.83.2 in the go_modules group across 1 directory #427's required "Nix flake builds" re-runs green; the auto-merge already armed on deps: bump google.golang.org/grpc from 1.83.1 to 1.83.2 in the go_modules group across 1 directory #427 lands it.

Until 2 and 3 are done the workflow fails closed at the token mint and pushes nothing; the PR stays exactly as red as it is today.