🌱 ci: run lint/build for meeting-recordings refresh PRs without a GitHub App

[clubanderson]

Why

The daily Refresh meeting recordings PR is pushed and opened with GITHUB_TOKEN, and GitHub never creates pull_request runs for such events. Since Lint and build, TypeScript & ESLint, Run unit tests and Audit production dependencies are required status checks on main, every refresh PR sat blocked (#331). #296/#305 added a create-github-app-token path that needs two repo secrets which were never provisioned.

Decision: no new secrets (option B)

workflow_dispatch and repository_dispatch are the two events GitHub does allow GITHUB_TOKEN to trigger, and a workflow_dispatch run on a branch reports its job check-runs on that branch's head SHA — which is exactly what branch protection keys on (contexts by job name, app_id 15368 = GitHub Actions).

• build.yml, typecheck.yml, vitest.yml, npm-audit.yml gain on: workflow_dispatch (npm-audit already had it).
• meeting-recordings-refresh.yml
  • drops the App-token step and the HAS_APP_SECRETS env;
  • after create-pull-request reports created/updated, runs gh workflow run <wf> --ref automation/meeting-recordings-refresh for the four CI workflows (actions: write added to the job);
  • the PR body now explains the mechanism and links the refresh run.
• Changelog fragment added; the old [ci-maintainer] meeting-recordings-refresh PR is opened with GITHUB_TOKEN so Build/npm audit never run on it; #293 merged with zero check-runs #296 fragment is left as history.

Verified locally with actionlint and scripts/changelog-fragments.test.ts. After merge I will trigger Refresh meeting recordings via workflow_dispatch and confirm the four check-runs appear on the new PR's head SHA.

Closes #337
Closes #335

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for hivecommons-docs ready!

Name	Link
🔨 Latest commit	4f5beb1
🔍 Latest deploy log	https://app.netlify.com/projects/hivecommons-docs/deploys/6ad63c6231f134d520e14939
😎 Deploy Preview	https://deploy-preview-391--hivecommons-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

@clubanderson is auto-promoted for contributor-lane merging on this PR: the last 5 merged PRs by this author in this repository have no revert or sentinel-alert evidence. CI, reviewer verdict, diff fences, soak, holds and branch protection still apply.

[hivecommons-hive]

4f5beb1

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @clubanderson, head 4f5beb1f7d94) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 5 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/build.yml
  • .github/workflows/meeting-recordings-refresh.yml
  • .github/workflows/npm-audit.yml
  • .github/workflows/typecheck.yml
  • .github/workflows/vitest.yml
• permission_escalation — widens workflow permissions or uses pull_request_target (Widens GitHub Actions permissions or switches to pull_request_target)
  • .github/workflows/meeting-recordings-refresh.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Evidence bundle `#3914f5beb1` sha256:31eda09fad2934a68bed074fac7d188ec95a468b20ac5959b13f694258aef2e9 — download from the dashboard or `hivectl review evidence #391`.

[hivecommons-hive]

merged by Hive trusted-author auto-merge: author @clubanderson holds role owner and GitHub permission admin on repo; CI green at 4f5beb1.

[clubanderson]

/lgtm

[clubanderson]

/approve