XS✔ ◾ Restore unattended CI dependency updates

.gitattributes

@@ -0,0 +1,6 @@
+.github/aw/actions-lock.json linguist-generated=true
+.github/workflows/*.lock.yml linguist-generated=true
+dist/exec-child.js linguist-generated=true
+dist/index.mjs linguist-generated=true
+dist/lib.json linguist-generated=true
+dist/resources.resjson linguist-generated=true

.github/dependabot.yml

@@ -9,6 +9,8 @@ updates:
     directories:
       - /
       - /.github/actions/mint-github-app-token
+    exclude-paths:
+      - .github/workflows/*.lock.yml
     open-pull-requests-limit: 100
     groups:
       codeql-action:

.github/workflows/build.yml

@@ -104,7 +104,7 @@ jobs:
         uses: super-linter/super-linter@2da136927bd4a73596db63044b504547c62cb854 # v9.0.0
         env:
           ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT: false
-          FILTER_REGEX_EXCLUDE: .*dist/.*
+          FILTER_REGEX_EXCLUDE: .*(dist/|\.github/workflows/.*\.lock\.yml).*
           FIX_JSON_PRETTIER: true
           FIX_MARKDOWN_PRETTIER: true
           FIX_MARKDOWN: true
@@ -141,13 +141,23 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
+      - name: Agentic Workflow – Verify
+        shell: bash
+        run: |
+          gh extension install github/gh-aw --pin v1.0.1
+          gh aw compile update-ci-dependencies --validate --no-check-update
+          git diff --exit-code -- .github/workflows/update-ci-dependencies.lock.yml .github/aw/actions-lock.json
+        env:
+          GH_TOKEN: ${{ github.token }}
+
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -217,7 +227,7 @@ jobs:
         uses: super-linter/super-linter@2da136927bd4a73596db63044b504547c62cb854 # v9.0.0
         env:
           ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
-          FILTER_REGEX_EXCLUDE: .*dist/.*
+          FILTER_REGEX_EXCLUDE: .*(dist/|\.github/workflows/.*\.lock\.yml).*
           GITHUB_TOKEN: ${{ github.token }}
           GITLEAKS_CONFIG_FILE: gitleaks.toml
           MARKDOWN_CONFIG_FILE: ../../.markdownlint.json

.github/workflows/pr-automation.yml

@@ -90,7 +90,7 @@ jobs:
       - name: App Token – Mint
         id: app-token
         # Use the controller action from the workflow's own revision.
-        uses: $/.github/actions/mint-github-app-token
+        uses: ./.github/actions/mint-github-app-token # zizmor: ignore[self-repository]
         with:
           azure-client-id: ${{ vars.AZURE_CLIENT_ID }}
           azure-tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -144,7 +144,7 @@ jobs:
         name: App Token – Mint
         id: app-token
         # Use the controller action from the workflow's own revision.
-        uses: $/.github/actions/mint-github-app-token
+        uses: ./.github/actions/mint-github-app-token # zizmor: ignore[self-repository]
         with:
           azure-client-id: ${{ vars.AZURE_CLIENT_ID }}
           azure-tenant-id: ${{ vars.AZURE_TENANT_ID }}

.github/workflows/release-initiate.yml

@@ -23,10 +23,11 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - name: Checkout – Action
+      - name: Checkout Trusted Action
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          ref: ${{ github.workflow_sha }}
           sparse-checkout: .github/actions
 
       - name: App Token – Mint
@@ -93,29 +94,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
-      - name: PR – Comment
-        run: |-
-          $body = @'
-          **Action required before merging**
-
-          Check out this release branch, then start GitHub Copilot CLI from the repository root:
-
-          ```bash
-          copilot
-          ```
-
-          In the interactive session, run this slash-command:
-
-          ```text
-          /refresh-ci-dependencies
-          ```
-
-          The skill updates SHA-pinned GitHub Actions and supported Azure DevOps task versions, and checks Node.js runtime consistency without upgrading Node.js. It then commits and pushes to this branch. These checks cover pins that automated dependency updates do not cover. See `.agents/skills/refresh-ci-dependencies/SKILL.md`. The skill runs only when you invoke the slash-command.
-          '@
-          gh pr comment "release/v$env:version" --body $body
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with: