ci: replace pull-request-target caller with automation template

[rtibblesbot]

Summary

The shared pull-request-target.yml dispatcher behind this repo's caller is being deleted, which would stop review-request routing, pull request labelling and dependabot reviewer assignment. This swaps the caller for an unedited copy of the org's generated automation template, keeping those three automations and switching on ten more that act on community contribution flows.

The copy must stay byte-identical to upstream. Its on: block is generated as the union of every enabled automation, so the file is the same in all eight consumer repos; automations are enabled and disabled org-wide in automation-registry.yml, never per repo.

References

Closes #170. Tracking: learningequality/.github#86.

Acceptance criteria not met

Criterion	Why it was left
Copy matches automation-template.yml on learningequality/.github@main	The template is not on main yet — it exists only on the consolidate-automation-entrypoint branch. The copy is byte-identical to that snapshot.
Merged only after learningequality/.github#88	Merge-time gate. #88 was open on 2026-09-16, titled [DO NOT MERGE].
LE_BOT_APP_ID and LE_BOT_PRIVATE_KEY resolve in a workflow run	Indirect evidence only — gh secret list 403s, so this rests on the old caller's last five runs all succeeding (2026-08-01) and release_ppa.yml feeding both to actions/create-github-app-token@v3 in a run that succeeded 2026-07-14. The new workflow's first run confirms it directly.
Optional secrets confirmed present or accepted as absent	gh secret list returns 403 at repo and org scope for this account, and no workflow here references SLACK_WEBHOOK_URL, SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL, CONTRIBUTIONS_SPREADSHEET_ID, CONTRIBUTIONS_SHEET_NAME or GH_UPLOADER_GCP_SA_CREDENTIALS, so there is no run evidence either. Needs an admin. The issue heads this list "four" and names five; five is correct per docs/automation.md.
Review requests, PR labelling and dependabot PRs behave as before	Post-merge check — nothing runs until this is on main. Also confirm unassign-inactive-issues after the first Monday 00:01 UTC run: success, or failure only on its Slack step.

Reviewer guidance

1. Re-run the upstream comparison before merge — it must print IDENTICAL:

   diff <(gh api repos/learningequality/.github/contents/automation-template.yml \
     --jq .content | base64 -d) .github/workflows/automation.yml && echo IDENTICAL

   On any diff, re-copy from main rather than reconciling by hand — the template is regenerated from the registry and can change between the branch snapshot and the merge commit.

Open risks:

• Merging before [DO NOT MERGE] Consolidate shared workflows into a single generated automation.yml entry point .github#88 leaves this repo with no automation: the copy calls automation.yml@main, which does not exist until Need option for a --debug flag #88 lands.
• An absent optional secret does not disable its automation. The key arrives empty at the leaf workflow and that step fails at run time; SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL alone reaches four automations.

AI usage

Used Claude Code to copy the upstream template, delete the old caller, and draft this description. Verified with a byte-diff against the upstream template, yamllint, and the full test suite.

🤖 Generated with Claude Code

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Ran pre-flight CI checks (lint, format, tests) and verified all pass
• Rebased onto the target branch and resolved any conflicts
• Reorganized commit history into clean, logical commits
• Audited the diff to ensure only issue-relevant files are changed
• Built PR body from the repository's PR template with evidence blocks

🟡 Waiting for feedback Last updated: 2026-09-16 13:41 UTC

[akolson]

Follow-up, not a blocker for this pull request: #172 asks for the five optional automation secrets.

This repo can already see LE_BOT_APP_ID and LE_BOT_PRIVATE_KEY, so the automations carried over from the old caller work after merge. Four of the automations this adds use optional secrets the repo cannot see, and each one fails at run time when an outside contributor triggers it. update-pr-spreadsheet is the one to watch, because its job has no guard on the secret at all.