Migrate to the shared automation-template.yml entry point

[akolson]

Overview

This repo copies one caller workflow from learningequality/.github, call-pull-request-target.yml.
learningequality/.github#88 deletes the reusable workflow behind it, so that caller must be replaced
with the new shared template. The template also switches on ten automations this repo does not run
today, so please confirm that you want them before merging.

Complexity: Low
Target branch: release-v0.9.x

Context

call-pull-request-target.yml calls pull-request-target.yml in learningequality/.github, which
routes three automations: review-requested, pull-request-label and dependabot-reviewer.

learningequality/.github#88 flattens that dispatcher into a central reusable automation.yml and
deletes pull-request-target.yml. Once that merges, this repo's caller breaks, so the two changes
must land together.

The replacement is one template that every consumer copies. Its on: block is generated as the
union of every enabled automation, so it is the same file everywhere. There is no per-repo subset:
learningequality/.github#86 chose central control, with automations enabled or disabled for the
whole org in a registry.

The Change

Replace call-pull-request-target.yml with one copy of automation-template.yml from
learningequality/.github, saved as .github/workflows/automation.yml. Do not edit the copy.

This repo keeps the three automations it runs today and gains ten more:

Automation	Trigger
contributor-pr-reply	Pull request opened by a contributor
holiday-message	Pull request opened, issue comment created
issue-open	Issue opened or reopened
issue-label-header	Issue labeled or unlabeled help wanted
good-first-issue-comment	Issue labeled good first issue or help wanted
update-pr-spreadsheet	Pull request assigned, opened, closed, edited, and more
community-contribution-label	Issue assigned or unassigned
contributor-issue-comment	Issue comment created
resolve-bot-pr-threads	Pull request review comment created
unassign-inactive-issues	Weekly schedule and manual dispatch

Most of these act on community contribution flows. If this repo receives no community issues or
pull requests, they stay quiet.

Out of Scope

• Changing what any automation does.
• Editing the copied template to remove automations. The on: block is generated, and a local edit
  will drift from learningequality/.github.

Coordination

learningequality/.github#88 is the source of truth for this migration. Read it for the design, the
full consumer list, and the current state.

Do not merge this repo's pull request on its own. The order is fixed:

1. Every migration pull request, across all eight consumer repos, is approved and left unmerged.
2. Consolidate shared workflows into a single generated automation.yml entry point .github#88 merges first. From that point, any repo that has not merged yet loses
   review-requested, pull-request-label and dependabot-reviewer, because that pull request
   deletes the pull-request-target.yml that the old caller uses.
3. The eight migration pull requests merge in succession, straight after. Each merge restores its
   own repo.

Merging this repo's pull request first does not work either. The copied template calls
automation.yml@main, and that file does not exist until learningequality/.github#88 lands.

Acceptance Criteria

• .github/workflows/automation.yml is an unedited copy of automation-template.yml from
  learningequality/.github@main.
• call-pull-request-target.yml is deleted.
• This pull request is merged only after Consolidate shared workflows into a single generated automation.yml entry point .github#88.
• LE_BOT_APP_ID and LE_BOT_PRIVATE_KEY resolve in a workflow run in this repo.
• The four optional secrets are confirmed present or accepted as absent. They are
  SLACK_WEBHOOK_URL, SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL,
  CONTRIBUTIONS_SPREADSHEET_ID, CONTRIBUTIONS_SHEET_NAME and
  GH_UPLOADER_GCP_SA_CREDENTIALS. An absent secret does not disable its automation. The
  automation runs and its step fails.
• After merge, requesting a review, labeling a pull request, and opening a dependabot pull
  request each behave as they did before.

Testing

1. Request a review on a test pull request. Confirm that the reviewer routing still runs.
2. Add a label to a test pull request. Confirm that the label handling still runs.
3. Open a test issue and label it help wanted. Confirm that the header is added.
4. Check the Actions tab after the first weekly run. Confirm that unassign-inactive-issues
   either succeeds or fails only on the Slack step.

References

• Consolidate shared workflows into a single generated automation.yml entry point .github#88 is the source of truth for this migration.
• Consolidate shared workflows into a single generated automation.yml entry point .github#86 is the original tracking issue. It stays open until all eight
  migrations land.
• docs/automation.md in learningequality/.github describes the entry point and the secrets.

AI usage

I used Claude Code to inspect the caller workflows in this repo and to draft this issue. I verified
the automation list and the secret names against learningequality/.github myself, and I edited the
wording.

[rtibblesbot]

Plan: Replace .github/workflows/call-pull-request-target.yml with a verbatim copy of automation-template.yml from learningequality/.github, saved as .github/workflows/automation.yml.

• Swap the caller workflow
• Verify secrets and set the merge gate
• Self-review the produced change

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Implemented code following the pre-approved plan using test-driven development (red-green-refactor)
• Ran the project's full test suite and linter before committing
• For UI changes: captured live screenshots to verify rendering
• For backend changes: verified with example API/CLI output

[rtibblesbot]

Blocker for AC "LE_BOT_APP_ID and LE_BOT_PRIVATE_KEY resolve in a workflow run": LE_BOT_APP_ID is empty in this repo. An org or repo admin needs to set both secrets; this PR cannot satisfy that criterion.

Every non-skipped run of call-pull-request-target.yml has failed — 32 failures, 5 skipped, 0 successes since the first run on 2026-06-26. All 32 fail identically at Generate App Token:

Error: The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context.

Latest: https://github.com/learningequality/morango/actions/runs/33453822106

This is pre-existing and not caused by the migration. After merge, 12 of the 13 automations fail at Generate App Token exactly as they do today, so AC "behave as they did before" holds either way. resolve-bot-pr-threads is the exception — it uses the default GITHUB_TOKEN and will start working.

gh api repos/learningequality/morango/actions/secrets returns 403 for a non-admin token, so run logs are the only evidence available here. The five optional secrets (SLACK_WEBHOOK_URL, SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL, CONTRIBUTIONS_SPREADSHEET_ID, CONTRIBUTIONS_SHEET_NAME, GH_UPLOADER_GCP_SA_CREDENTIALS) are unverifiable for the same reason — treated as accepted-as-absent, which means their automations run and fail at their own step rather than being disabled.

Note: ISSUE.md says "four optional secrets" then lists five. docs/automation.md upstream confirms five.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Queried this repo's workflow run history and failure logs via gh
• Verified the secret list against the copied automation.yml and upstream docs/automation.md
• Confirmed repo secrets are not readable with the available token (HTTP 403)