Prepare live Dependabot automation runs

Run live automation on pushes to cklin/dependabot-automation. Load
trusted controller and worker code from the exact pushed commit for
push events, preserving main checkouts for all other triggers.

Document the live-run behavior and follow-up processing after retries.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d63bcb34-3969-4d14-b422-33728176ec03

Author: cklin

.github/dependabot-automation/README.md

@@ -111,7 +111,11 @@ protocol.
 ## Trust boundaries and invariants
 
 Trusted controller and worker instructions are checked out from `main`, never from
-the PR. Dispatching a feature branch does not make these checkouts load that branch.
+the dependency PR. For temporary live testing, pushes to
+`cklin/dependabot-automation` instead load the exact pushed commit and perform
+real PR operations. Follow-up processing after a CI retry requires another push
+until the automation workflow is on `main`. Other triggers still load `main`;
+dispatching a feature branch does not change that.
 `GITHUB_TOKEN` handles discovery, evaluation, approval, and failure reporting.
 Separately scoped `codeql-ci-app` tokens perform retries, merges, and publication.
 The worker receives only a read/inference token, never App credentials, and the CLI

.github/workflows/dependabot-automation.yml

@@ -1,6 +1,8 @@
 name: Dependabot automation
 
 on:
+  push:
+    branches: [cklin/dependabot-automation]
   workflow_run:
     workflows:
       [
@@ -38,8 +40,8 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          # workflow_run is privileged: always load controller code from main.
-          ref: main
+          # Only branch-push live tests load the pushed code; other events use main.
+          ref: ${{ github.event_name == 'push' && github.sha || 'main' }}
           persist-credentials: false
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         id: discover

.github/workflows/dependabot-pr.yml

@@ -24,7 +24,7 @@ jobs:
   evaluate:
     runs-on: ubuntu-latest
     permissions:
-      # Required to disarm native auto-merge. This job only runs main's controller.
+      # Required to disarm native auto-merge; this job only runs trusted code.
       contents: write
       actions: read
       pull-requests: write
@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: main
+          ref: ${{ github.event_name == 'push' && github.sha || 'main' }}
           persist-credentials: false
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         id: evaluate
@@ -63,7 +63,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: main
+          ref: ${{ github.event_name == 'push' && github.sha || 'main' }}
           persist-credentials: false
       - name: Mint retry token
         id: app
@@ -103,7 +103,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: main
+          ref: ${{ github.event_name == 'push' && github.sha || 'main' }}
           persist-credentials: false
       - name: Approve pristine passing update
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -143,7 +143,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: main
+          ref: ${{ github.event_name == 'push' && github.sha || 'main' }}
           path: trusted
           persist-credentials: false
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -211,7 +211,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: main
+          ref: ${{ github.event_name == 'push' && github.sha || 'main' }}
           persist-credentials: false
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
@@ -252,7 +252,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: main
+          ref: ${{ github.event_name == 'push' && github.sha || 'main' }}
           persist-credentials: false
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with: