DO NOT MERGE before learningequality/.github#88 — replace the seven automation callers with the central entry point

[rtibblesbot]

⛔ Merge order

Merge only after learningequality/.github#88 — the copy calls
learningequality/.github/.github/workflows/automation.yml@main, which does not exist until #88 lands.

Summary

Every automation here fires through its own caller workflow carrying a hand-maintained types: list,
so enabling or disabling one means editing all eight consumer repos, and the lists have drifted. This
swaps the seven callers for one unedited copy of the generated automation-template.yml, which routes
every event to the central reusable workflow. The repo gains two automations it did not run:
resolve-bot-pr-threads, via the new pull_request_review_comment: created trigger, and
good-first-issue-comment. Top-level permissions widen from contents: read to contents: write +
pull-requests: write, the union across automations, which the central workflow narrows back to
contents: read on every other job.

Acceptance criteria not met

Criterion	Why it is open
Copy comes from learningequality/.github@main	The template is only on the #88 branch; main returns 404. Copied verbatim from that branch — re-diff against main before merging.
Merged only after learningequality/.github#88	A merge-time constraint, not a property of the diff. Opened as draft to hold it.
LE_BOT_APP_ID / LE_BOT_PRIVATE_KEY resolve in a run	No run is possible until #88 lands. The copy passes the same seven secret names the callers passed.
Listed events fire the automations they fired before	Post-merge live check. Static trigger parity holds: one addition, no removals.
Weekly unassign-inactive-issues fires Mondays 00:01 UTC	Observable on the first Monday after merge. The copy keeps cron: 1 0 * * 1.

Reviewer guidance

1. Confirm the copy is unedited — no output expected:
   gh api 'repos/learningequality/.github/contents/automation-template.yml?ref=consolidate-automation-entrypoint' --jq .content | base64 -d | diff - .github/workflows/automation.yml
2. Compare the on: blocks of the deleted callers (git show HEAD~1:.github/workflows/<file>) against
   the copy: pull_request_review_comment: created is added, nothing is removed, and the same seven
   secret names get passed through.

The copy is generated upstream, so a defect in it is fixed in #88 rather than here.

References

• Closes Migrate to the shared automation-template.yml entry point #6135
• Source of truth: [DO NOT MERGE] Consolidate shared workflows into a single generated automation.yml entry point .github#88 — tracking: Consolidate shared workflows into a single generated automation.yml entry point .github#86
• Copy: automation-template.yml at learningequality/.github@consolidate-automation-entrypoint,
  sha256 83cd047c492b0a7d7949f12045a1e661003f3d11450f0663a92adfba06449f5d

AI usage

Used Claude Code to fetch the template unedited, delete the seven callers, and diff trigger and secret
parity against the pre-deletion baseline. Verified with a byte-for-byte diff against upstream and
pre-commit run --all-files.

🤖 Generated with Claude Code

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Ran pre-flight CI checks (lint, format, tests) and verified all pass
• Rebased onto the target branch and resolved any conflicts
• Reorganized commit history into clean, logical commits
• Audited the diff to ensure only issue-relevant files are changed
• Built PR body from the repository's PR template with evidence blocks

🟡 Waiting for feedback Last updated: 2026-09-16 14:12 UTC

[rtibblesbot]

This adopts three automations the repo does not run today, not two. The third is holiday-message, and it is a blocker.

• This repo deleted call-holiday-message.yml in addf9f5 ("Remove call-holiday-message github action post-holiday", Jan 2026).
• automation-registry.yml has it enabled: true, and entries carry no per-repo scoping key — enabled, if, leaf, on, permissions, secrets only.
• holiday-message.yml has no date guard; its only if: is the contributor check.

Net: merging as-is posts the holiday message on every pull request opened and every issue comment, year-round.

The trigger-parity diff could not catch this. pull_request_target: [opened] and issue_comment: [created] are already in the union from other automations, so the on: block is byte-identical either way. Parity is over events, not over which leaves run.

Class check — mapped all 13 registry entries against the 7 deleted callers. The callers cover 10 entries, not the 11 the issue states (call-manage-issue-header.yml is one caller but two entries, issue-open + issue-label-header). Three are gained: good-first-issue-comment and resolve-bot-pr-threads are intended; holiday-message is not. No other registry entry corresponds to an automation this repo had deliberately removed.

The copy is generated and must not be edited here, so the fix is enabled: false in the registry, in learningequality/.github#88, before either pull request merges. Raised there.

Separately: the merge-order hold is the DO NOT MERGE title and this body, nothing more. This account cannot convert the pull request to a draft (gh pr ready --undo is denied), so do not rely on draft state to block the merge.