ci: guard downstream QPK pin writers

[Pigbibi]

Summary

• make downstream QPK pin PR opening explicit-only via workflow_dispatch
• ignore the two automation-only workflow paths in Update QPK Pin
• preserve normal source-push pin-update semantics and required CI

Tests-first proof

• exact-base static proof: pin-file pushes triggered the downstream opener; both workflow-only pushes triggered Update QPK Pin
• candidate static proof: opener has no push; both workflow paths are exactly ignored; normal source pushes still trigger

Validation

• actionlint
• YAML parse/static semantic assertions
• git diff --check
• exact two-file scope gate
• added-line secret gate

No workflow was dispatched or rerun.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b17335d51e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict downstream dispatches to main

Now that the main-branch push trigger was removed, the only path to this writer is workflow_dispatch, but the job no longer restricts the selected ref. GitHub's manual-run docs expose a Branch selector / gh workflow run --ref BRANCH (https://docs.github.com/actions/managing-workflow-runs/manually-running-a-workflow), and actions/checkout checks out the event ref by default (https://github.com/actions/checkout#usage); if a maintainer dispatches this from a feature branch or tag, scripts/open_downstream_qpk_pin_prs.py reads that ref's QPK_PIN and opens PRs in every downstream repo for a pin that may never have landed on main. Add a job-level if: github.ref == 'refs/heads/main' or checkout main explicitly before using QSL_REPO_SYNC_TOKEN.

Useful? React with 👍 / 👎.