ci: auto-regenerate snippets on dependabot PRs

[ksroda-sa]

Problem

snippets.json embeds a lib_version per framework, read from the sample's package.json for the library named in that framework's manifest.yaml lib: field. When dependabot bumps one of those 12 libraries, yarn extract produces a different snippets.json, so the Verify no drift step in the validate job fails and auto-merge stalls until someone runs cd scripts && yarn all by hand.

Currently red for this reason: #385, #386, #383 (all three fixed by hand; this makes it automatic).

Change

A refresh-snippets job in extract.yml that runs only on dependabot PRs, re-runs aggregate + extract, and pushes the regenerated artifacts back to the PR branch. The resulting commit re-runs the checks, they go green, and auto-merge proceeds.

Notes on the approach:

• Keys off detected drift, not package names. No list of libraries to keep in sync, and the per-scenario lib: overrides (dotnet/java/node SAML) are covered for free.
• Re-approves and re-arms auto-merge after pushing. Verified against the three PRs above: pushing a commit dismisses dependabot's stale approval under branch protection, and the dependabot-auto-merge run that commit triggers skips itself because github.actor is then the service account, not dependabot[bot]. Without this step the PR ends up green but unapproved and no longer queued to merge.
• The PAT is scoped to the push step. Checkout uses the read-only default token with persist-credentials: false, so no write-scoped credential sits in .git/config while yarn install runs dependency build scripts. GH_SERVICE_ACCOUNT_DEVOPS_2_PAT1 is supplied to the push and to the gh calls only. It is required — GITHUB_TOKEN is read-only on dependabot events, and a push made with it would not re-trigger the required checks. Confirmed present in the Dependabot secret store (dependabot-auto-merge already uses it and succeeds).
• validate is untouched. It still goes red on the pre-fix SHA; branch protection and auto-merge evaluate the new SHA, which is green.

Side effect

Pushing to a dependabot branch stops dependabot from rebasing it further. Acceptable here — these PRs auto-merge immediately after.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds CI automation to keep generated snippet artifacts (snippets.json / snippet-manifest.yaml) in sync on Dependabot PRs by regenerating and pushing updated artifacts back to the PR branch, unblocking required checks and auto-merge when dependency bumps change embedded library versions.

Changes:

• Introduces a refresh-snippets job that runs on pull_request events authored by dependabot[bot].
• Re-runs yarn aggregate + yarn extract, then commits and pushes regenerated artifacts when drift is detected.

Suppressed comments (1)

.github/workflows/extract.yml:100

• With persist-credentials: false (or if checkout ends up detached), a plain git push can fail or push to an unintended ref. Push explicitly to the PR branch and only after configuring auth for that push.

          git commit -m "chore: regenerate snippets for dependency bump"
          git push

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/extract.yml:64

• The refresh-snippets job will run on every Dependabot PR event, including the pull_request:synchronize event triggered by this workflow’s own push (where github.actor becomes the service account). That causes an extra (potentially repeated) full yarn install/aggregate/extract run even when there’s no drift, and increases the risk of a push loop if extraction output is ever non-deterministic. You can avoid this by (1) gating the job on github.actor == 'dependabot[bot]' and (2) running only when validate failed (typically due to drift), using needs + always() so the job still runs when validate fails.

  refresh-snippets:
    if: >-
      github.event_name == 'pull_request' &&
      github.event.pull_request.user.login == 'dependabot[bot]'
    runs-on: ubuntu-latest