[DO NOT MERGE] Migrate to the shared automation.yml entry point

[rtibblesbot]

Summary

The dispatcher behind this repo's call-pull-request-target.yml is being deleted upstream, which would leave review-request routing, pull-request labelling and dependabot review assignment with nothing to call. This replaces that caller with .github/workflows/automation.yml, a verbatim copy of the generated shared template: the repo keeps those three automations and gains ten more, mostly community-contribution flows. The copy is never edited locally — its on: block is the generated union of all 13 automations, and enable/disable is central upstream in automation-registry.yml.

Acceptance criteria not met

Criterion	Why it was left
Copy is taken from learningequality/.github@main	automation-template.yml does not exist on main yet (404). The copy is byte-identical to the consolidate-automation-entrypoint branch; re-diff against main before merging.
Merged only after learningequality/.github#88	#88 is open. Order: all eight consumer PRs approved and left unmerged → #88 merges → the eight merge in succession. Held by the [DO NOT MERGE] title prefix only.
LE_BOT_APP_ID and LE_BOT_PRIVATE_KEY resolve in a workflow run	LE_BOT_APP_ID is empty in this repo — all 32 non-skipped runs of the old caller since 2026-06-26 failed at Generate App Token, 0 succeeded. Pre-existing; needs an admin to set both.
Post-merge behaviour of review request, PR label and dependabot PR	Not exercisable until #88 and this PR merge. Once merged, 12 of the 13 automations fail at Generate App Token exactly as today; resolve-bot-pr-threads uses GITHUB_TOKEN and starts working.

TODO

• Have tests been written for the new code? — n/a, no code; GitHub evaluates the workflow.
• Has documentation been written/updated? — n/a, documented upstream in docs/automation.md.
• New dependencies (if any) added to requirements file — n/a.

Reviewer guidance

1. Diff the copy against upstream rather than reading it as hand-written YAML — expect no output:

   gh api "repos/learningequality/.github/contents/automation-template.yml?ref=consolidate-automation-entrypoint" \
     --jq '.content' | base64 -d | diff - .github/workflows/automation.yml
   

   Drop the ?ref= once the upstream PR merges.
2. prek run --all-files passes with the copy unmodified.

• Deliberate, please don't request changes on these: no concurrency/pre_job house pattern (does not apply to a generated copy), unused on: types and secrets: keys (part of the generated union), no CHANGELOG.md entry (CI-only).
• Decided, not outstanding: the five optional secrets (SLACK_WEBHOOK_URL, SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL, CONTRIBUTIONS_SPREADSHEET_ID, CONTRIBUTIONS_SHEET_NAME, GH_UPLOADER_GCP_SA_CREDENTIALS) are accepted as absent — the secrets API reads 403 with this token, so presence is unconfirmable either way. An absent one does not disable its automation; the automation runs and its own step fails.

Issues addressed

Closes #352. Blocked by learningequality/.github#88. Part of learningequality/.github#86.

Documentation

docs/automation.md in learningequality/.github.

AI usage

Used Claude Code to copy the template, delete the old caller, and read this repo's run history for the secret state. Verified with a byte-diff against upstream and prek run --all-files.

🤖 Generated with Claude Code

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Ran pre-flight CI checks (lint, format, tests) and verified all pass
• Rebased onto the target branch and resolved any conflicts
• Reorganized commit history into clean, logical commits
• Audited the diff to ensure only issue-relevant files are changed
• Built PR body from the repository's PR template with evidence blocks

🟡 Waiting for feedback Last updated: 2026-09-16 13:41 UTC

[akolson]

Follow-up, not a blocker for this pull request: #354 asks for the automation secrets, including the two required ones this repo cannot see.

LE_BOT_APP_ID and LE_BOT_PRIVATE_KEY are not visible here, so the existing automation has failed since at least August. Run 33453822106 shows the empty app-id input. Merging this does not cause that and does not fix it, but it does widen it from three failing automations to twelve. Expect those failures until #354 is done.