ci: automate the lock-file fix that keeps breaking Dependabot's nuget PRs

[bgard68]

Dependabot regenerates packages.lock.json only for the projects whose .csproj it edits. Every project consuming the bumped package transitively keeps its old lock file, and locked-mode restore fails the whole solution with NU1004 — the PR is born red, and rebasing cannot help. Grouping (#126) turned five such PRs into one; this closes the loop on that one. It broke three workflows across two branches on 2026-08-17 alone, and the fix each time was the same mechanical dotnet restore --force-evaluate by hand.

What's added

dependabot-lockfix.yml — fires on any failed API / CodeQL / container run of a dependabot/nuget/** branch, regenerates the lock files, pushes the fix to the branch, and re-dispatches every required check on the fixed commit. Zero secrets, zero PATs. The three GitHub platform constraints that dictate its shape are documented in the file:

1. Runs whose actor is dependabot[bot] get read-only tokens → workflow_run is the one trigger that still gets write.
2. GITHUB_TOKEN pushes trigger no workflows → the fixed commit would sit checkless forever.
3. workflow_dispatch is the documented exception to (2) → the last step re-dispatches all required checks, all of which already declare it.

It lives on main only because workflow_run only fires from the default branch's copy; it serves dapper-based Dependabot branches from here. Also manually dispatchable against any branch.

api-ci-cd.yml — gains a deploy input (default true) and the deploy gate becomes

if: github.ref == 'refs/heads/main' || (github.event_name == 'workflow_dispatch' && inputs.deploy)

Until now any manual dispatch deployed, so an automated checks-only rerun of a Dependabot branch would have shipped that branch to the App Service. Default true keeps the operator flow identical: Run workflow on main with the box ticked deploys exactly as before.

Edge behavior

• Dependabot branches forked before this commit lack the deploy input; a deploy=false dispatch against them fails 422 Unexpected inputs — a loud no-op rather than a deploy. Self-heals as branches re-fork off the updated base.
• If a re-dispatched run fails for a real reason, the fixer fires again, finds nothing to regenerate, and stops. No loop.
• npm (frontend) and github-actions bumps are excluded: single root lock file handled correctly, and no lock file at all, respectively.

Verification

Both files parse; the gate expression is push-safe (inputs is empty on push events, so main still auto-deploys via the first clause). The full loop gets its first live test on the next grouped nuget PR — until then the manual dispatch path covers any occurrence.

🤖 Generated with Claude Code