[sync] Create .github/workflows/dispatch-review.yaml

[automation-nsheaps]

Org-sync from nsheaps/.github

Direct push was blocked by branch protection. This PR applies the
central file update via the standard PR flow.

Path: .github/workflows/dispatch-review.yaml
Action: Create

Branch org-sync/-github-workflows-dispatch-review-yaml is stable — subsequent runs update this PR.

[henry-nsheaps]

Review — Dispatch PR Review workflow template

Adds .github/workflows/dispatch-review.yaml, a thin gate that fires the shared nsheaps/agents/.github/workflows/review-dispatch.yaml decider on PR events. The file is well-scoped, well-documented, and correctly SHA-pinned. Three P2 nits below — none block; nothing critical.

Verdict: 💬 COMMENT — three P2 improvements, no P0/P1.

Scores — Correctness 8 · Simplicity 9 · Security 9 · Maintainability 7 · Docs 7

Dimension	Score	Notes
Correctness	8/10	Gate logic works for happy path; labeled re-fires on any label change (P2).
Simplicity	9/10	Delegates all real work to the reusable workflow; template stays declarative.
Security	9/10	SHA-pinned reusable + third-party actions; least-priv scopes; automation-only creds.
Maintainability	7/10	Comment block on lines 64–67 contradicts the SHA-pin on line 68 (P2).
Docs / accuracy	7/10	Commented event-type: pr-review example refers to an input that does not exist (P2).

Strengths

• Header (lines 1–27) is genuinely useful: role, secrets rationale, cross-repo App-install requirements, and an explicit call-out that LLM secrets live on the receiver — future readers won't have to reverse-engineer this.
• Top-level + job-level permissions blocks are least-privilege (contents: read, pull-requests: write, checks: write) and the top-level block is explicitly annotated as satisfying checkov CKV2_GHA_1.
• Reusable workflow is SHA-pinned (@9384e01…) with a trailing # main ref annotation — correct supply-chain posture for a template that will be synced into many consumer repos.
• Third-party actions in the upstream reusable are also SHA-pinned (actions/create-github-app-token@f8d387b…, LouisBrunner/checks-action@937cbbc…, peter-evans/repository-dispatch@28959ce…) — verified via agent-repo/.github/workflows/review-dispatch.yaml.
• Explicit secrets: passthrough with the "secrets: inherit doesn't pass cross-repo" comment is the right call and pre-empts a common footgun.

Follow-ups (all P2)

1. 🟡 Comment/code contradiction on the uses: pin (lines 64–68) — block describes @main rolling-update behavior and tells operators to "replace @main with a commit SHA" for stability, but the code already IS SHA-pinned. Rewrite the comment for the actual (pinned) posture, or switch uses: back to @main. Suggestion inline. comment
2. 🟡 labeled re-fires on any label add to non-draft PRs (lines 33 + 52–57) — because draft != true short-circuits before the label-name check, adding an unrelated label to a ready-for-review PR re-dispatches and burns another full review (LLM tokens + runner minutes + fresh check). Tighten the if: to require label.name == 'request-review' on any labeled event, or document that the noise is intentional. Suggestion inline. comment
3. 🟡 Commented example advertises an input that doesn't exist (lines 73–76) — event-type: pr-review would fail with Invalid input if uncommented; the reusable workflow only declares target-repo, and the downstream repository_dispatch event_type is hardcoded upstream as ${{ github.event_name }}/${{ github.event.action }}. Drop the phantom line from the example. Suggestion inline. comment

How I evaluated this

• Fetched the PR metadata + diff (gh api repos/nsheaps/github-actions/pulls/119{,/files,/reviews,/comments}) — 1 file, +76/-0, no prior reviews or inline threads to reconcile against.
• Read the full new file at /home/runner/work/.ai-agent-henry/.ai-agent-henry/trigger-repo/.github/workflows/dispatch-review.yaml (checked-out copy after sync).
• Cross-checked the reusable workflow it calls at agent-repo/.github/workflows/review-dispatch.yaml to verify (a) which inputs are actually declared — only target-repo, (b) how event_type is derived for the dispatched event, (c) that third-party actions are SHA-pinned, and (d) that the receiver — not this gate — owns the reviewer identity + LLM secrets. This is where finding #3 comes from.
• Traced each branch of the if: condition against github.event.action values for opened / reopened / synchronize / ready_for_review / labeled and against draft = true/false — finding #2 is the labeled + non-draft + arbitrary label cell.
• Compared the comment prose on lines 64–67 against the actual uses: value on line 68 — finding #1.
• Sanity-checked the existing repo layout (.github/workflows/{check,pages,sync-main-to-edge,sync-plugin-specs}.yaml) to confirm this is a net-new workflow and not a modification of anything already present.

_{Reviewed by henry-nsheaps[bot] · run}