ci: auto-regenerate snippets on dependabot PRs

.github/workflows/extract.yml

@@ -48,6 +48,83 @@ jobs:
           git diff --exit-code snippets.json snippet-manifest.yaml || \
             (echo "::error::Extracted artifacts are out of date. Run 'cd scripts && yarn all' and commit the results." && exit 1)
 
+  # Dependabot bumps of a library whose version is embedded in snippets.json
+  # (the `lib:` field of a samples/*/manifest.yaml) leave the extracted artifacts
+  # stale, so `validate` fails on an otherwise-fine PR. Regenerate and push back
+  # to the PR branch; the resulting commit re-runs the checks and auto-merge
+  # proceeds. Detecting drift beats matching package names — no list to keep in
+  # sync, and it covers the per-scenario `lib:` overrides too.
+  #
+  # The PAT is required: GITHUB_TOKEN is read-only on Dependabot events, and a
+  # push made with it would not re-trigger the required checks.
+  refresh-snippets:
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      # Checked out with the read-only default token and `persist-credentials:
+      # false`, so no write-scoped credential sits in .git/config while the
+      # dependency install and extract run. The PAT is handed to the push alone.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.head_ref }}
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: "22"
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Install dependencies
+        working-directory: scripts
+        run: yarn install --immutable
+
+      - name: Aggregate manifests
+        working-directory: scripts
+        run: yarn aggregate
+
+      - name: Extract snippets
+        working-directory: scripts
+        run: yarn extract
+
+      - name: Commit regenerated artifacts
+        id: commit
+        env:
+          # Referenced as shell variables rather than interpolated into the
+          # script, so a branch name can't inject into the run block.
+          TOKEN: ${{ secrets.GH_SERVICE_ACCOUNT_DEVOPS_2_PAT1 }}
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          if git diff --quiet snippets.json snippet-manifest.yaml; then
+            echo "Artifacts already up to date — nothing to push."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add snippets.json snippet-manifest.yaml
+          git commit -m "chore: regenerate snippets for dependency bump"
+          git push "https://x-access-token:${TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
+            "HEAD:refs/heads/${HEAD_REF}"
+          echo "pushed=true" >> "$GITHUB_OUTPUT"
+
+      # Pushing here has two side effects that have to be undone. Branch
+      # protection dismisses stale approvals on a new commit, and the
+      # dependabot-auto-merge run that commit triggers skips itself because
+      # `github.actor` is now the service account rather than dependabot[bot].
+      # Without this the PR ends up green but unapproved and no longer queued
+      # to auto-merge.
+      - name: Re-approve and re-arm auto-merge
+        if: steps.commit.outputs.pushed == 'true'
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GH_SERVICE_ACCOUNT_DEVOPS_2_PAT1 }}
+
   commit:
     needs: validate
     if: github.event_name == 'push'