feat(harness): expand vault-dispatch to issues/comments/reviews/release

.github/workflows/api-server-invariants.yml

@@ -22,7 +22,7 @@ jobs:
   invariants:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       # OPERATION_DATABASE_URL is the SOT operation DB env var (#369).
       # prod / staging / dev infra all set OPERATION_DATABASE_URL only;

.github/workflows/backend-release.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/daily-digest.yml

@@ -29,7 +29,7 @@ jobs:
   digest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

.github/workflows/db-drift-check.yml

@@ -31,7 +31,7 @@ jobs:
       PRD_DATABASE_URL: ${{ secrets.PRD_DATABASE_URL }}
       LOCAL_DATABASE_URL: postgresql://postgres:testpass@localhost:5432/drift_test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install postgresql-client 17
         run: |

.github/workflows/deploy-backend.yml

@@ -26,7 +26,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Copy env file
         run: cp /Users/decoded/dev/decoded/.env.backend.prod .env.backend.prod

.github/workflows/health-check.yml

@@ -12,7 +12,7 @@ jobs:
   health-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Check API health and notify
         env:

.github/workflows/vault-dispatch.yml

@@ -4,6 +4,14 @@ on:
     branches: [main, dev]
   pull_request:
     types: [opened, closed]
+  pull_request_review:
+    types: [submitted]
+  issues:
+    types: [opened, closed, reopened, labeled, assigned]
+  issue_comment:
+    types: [created]
+  release:
+    types: [published]
   deployment_status:
 
 permissions:
@@ -43,6 +51,43 @@ jobs:
               fi
               BODY="**PR #${NUM}** ${TITLE} (${TYPE} by ${ACTOR})"
               ;;
+            pull_request_review)
+              NUM=$(jq -r '.pull_request.number' "$GITHUB_EVENT_PATH")
+              TITLE=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH")
+              STATE=$(jq -r '.review.state' "$GITHUB_EVENT_PATH")
+              TYPE="pr-review-${STATE}"
+              BODY="**PR #${NUM}** ${TITLE} (review-${STATE} by ${ACTOR})"
+              ;;
+            issues)
+              NUM=$(jq -r '.issue.number' "$GITHUB_EVENT_PATH")
+              TITLE=$(jq -r '.issue.title' "$GITHUB_EVENT_PATH")
+              EXTRA=""
+              case "$EVENT_ACTION" in
+                labeled)
+                  LABEL=$(jq -r '.label.name // ""' "$GITHUB_EVENT_PATH")
+                  EXTRA=" [+${LABEL}]"
+                  ;;
+                assigned)
+                  ASSIGNEE=$(jq -r '.assignee.login // ""' "$GITHUB_EVENT_PATH")
+                  EXTRA=" → ${ASSIGNEE}"
+                  ;;
+              esac
+              TYPE="issue-${EVENT_ACTION}"
+              BODY="**Issue #${NUM}** ${TITLE}${EXTRA} (${TYPE} by ${ACTOR})"
+              ;;
+            issue_comment)
+              NUM=$(jq -r '.issue.number' "$GITHUB_EVENT_PATH")
+              TITLE=$(jq -r '.issue.title' "$GITHUB_EVENT_PATH")
+              SNIPPET=$(jq -r '.comment.body // ""' "$GITHUB_EVENT_PATH" | head -1 | head -c 120)
+              TYPE="issue-comment"
+              BODY="**Issue #${NUM}** ${TITLE} — comment by ${ACTOR}: ${SNIPPET}"
+              ;;
+            release)
+              TAG=$(jq -r '.release.tag_name // ""' "$GITHUB_EVENT_PATH")
+              NAME=$(jq -r '.release.name // ""' "$GITHUB_EVENT_PATH")
+              TYPE="release-${EVENT_ACTION}"
+              BODY="**Release ${TAG}** ${NAME} (${TYPE} by ${ACTOR})"
+              ;;
             deployment_status)
               STATE=$(jq -r '.deployment_status.state' "$GITHUB_EVENT_PATH")
               ENV_NAME=$(jq -r '.deployment_status.environment // "unknown"' "$GITHUB_EVENT_PATH")

.github/workflows/wiki-lint.yml

@@ -15,7 +15,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with: