chore(deps): bump the npm-dependencies group across 1 directory with 21 updates #260
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # LOCKED template — the per-repo caller for the loop-dispatch reusable workflow. | |
| # Commit verbatim to each target repo as `.github/workflows/loop-dispatch.yml`. | |
| # It declares every loop event (issue labels + PR labels — Actions has no | |
| # event-type-mixing limit, unlike the routines UI) and calls the reusable workflow in | |
| # umbraco-mcp-ops, which routes at the edge and fires the repo's routine only on a real | |
| # match. No per-repo edits: the two secrets carry everything repo-specific. | |
| # | |
| # PR labels use `pull_request_target`, NOT `pull_request`: `pull_request` resolves the | |
| # workflow from the PR's BASE branch, and our loop PRs target `dev` (a non-default | |
| # branch), where GitHub does not fire the `labeled` trigger. `pull_request_target` always | |
| # runs from the base repo's DEFAULT branch, WITH secrets, regardless of the PR's base — so | |
| # `auto-merge` / `auto-rework` fire on dev-based PRs. It's safe here because this caller | |
| # never checks out or executes PR head code — it only forwards event metadata to the | |
| # reusable workflow, which routes on the payload and checks out trusted mcp-ops. | |
| # | |
| # `issue_comment` is the one trigger that isn't label-driven: it carries the next round of an | |
| # `ai-discuss` conversation. It fires on EVERY comment on every issue and PR in the repo, and | |
| # the gating happens at the edge in route-event.sh (issue carries `ai-discuss` and is open, the | |
| # comment is neither the loop's own nor `//`-prefixed, the author is trusted, not a PR) — so a | |
| # normal comment costs one short Actions job and wakes no routine. | |
| # | |
| # Requires two secrets on the repo (or the org): | |
| # LOOP_DISPATCH_FIRE_URL — the routine's Fire URL (Routines UI → Call via API) | |
| # LOOP_DISPATCH_TOKEN — the token generated for that routine | |
| name: loop-dispatch | |
| on: | |
| issues: | |
| types: [labeled] | |
| pull_request_target: | |
| types: [labeled] | |
| issue_comment: | |
| types: [created] | |
| jobs: | |
| dispatch: | |
| uses: hifi-phil/umbraco-mcp-ops/.github/workflows/loop-dispatch.yml@main | |
| # Pass explicitly — NOT `secrets: inherit`. inherit only forwards secrets when the | |
| # caller and the reusable workflow share an org/enterprise; these repos are in | |
| # different owners (umbraco vs hifi-phil), so inherit would forward nothing. | |
| secrets: | |
| LOOP_DISPATCH_FIRE_URL: ${{ secrets.LOOP_DISPATCH_FIRE_URL }} | |
| LOOP_DISPATCH_TOKEN: ${{ secrets.LOOP_DISPATCH_TOKEN }} |