Trigger codegraph snapshot rebuild on main push

[JadeCara]

Summary

Sends a repository_dispatch event to ethyca/codegraph whenever fides main gets a new commit. This triggers a rebuild of the codegraph knowledge graph snapshot used by CI code-review workflows.

Uses the ethyca-cross-repo GitHub App token (same pattern as trigger_fidesplus_builds.yml).

Required setup

• CROSS_REPO_APP_ID var and CROSS_REPO_APP_PRIVATE_KEY secret configured in fides repo settings

Test plan

• Merge → next push to main triggers snapshot rebuild in codegraph repo

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
fides-plus-nightly	Ignored	Preview	Mar 27, 2026 8:38pm
fides-privacy-center	Ignored		Mar 27, 2026 8:38pm

[claude]

Clean, focused workflow that follows the existing trigger_fidesplus_builds.yml pattern well. A couple of minor notes:

Suggestions

• peter-evans/repository-dispatch@v3 uses a mutable tag while actions/create-github-app-token is pinned to a full commit SHA — worth pinning both for supply chain consistency.

Nice to have

• A concurrency group (cancel-in-progress) would avoid queuing redundant rebuilds when multiple commits land on main in quick succession.

Otherwise the logic is straightforward and correct — using ${{ github.sha }} directly avoids the need for a checkout step, the GitHub App token pattern is a good call, and the workflow_dispatch trigger is useful for manual resyncs.

[claude]

Suggestion: Pin peter-evans/repository-dispatch to a full commit SHA

actions/create-github-app-token is pinned to a specific commit hash (fee1f7d63c2ff003460e3d139729b119787bc349), but peter-evans/repository-dispatch@v3 uses a mutable tag. A mutable tag can be force-pushed by the upstream maintainer, which is a supply chain risk — a compromised tag could execute arbitrary code in this workflow.

Consider pinning to the commit SHA for v3, e.g.:

uses: peter-evans/repository-dispatch@ce57c68e63d0b9b4429076b60fa0f8f50de4cb40 # v3

You can find the SHA via git ls-remote https://github.com/peter-evans/repository-dispatch refs/tags/v3.

[claude]

Nice to have: Add a concurrency group to avoid redundant snapshot rebuilds

If several commits land on main in quick succession (e.g. a merge train or a batch of rebased commits), this workflow will queue a rebuild for each one. Since each new commit supersedes the previous snapshot, only the latest matters. A concurrency group that cancels in-progress runs would avoid wasted work in the codegraph repo:

concurrency:
  group: codegraph-snapshot
  cancel-in-progress: true

Low-priority — depends on how the codegraph rebuild handles concurrent triggers — but worth considering if rebuilds are expensive.

[JadeCara]

Updated blocker (simplified):
DISPATCH_ACCESS_TOKEN PAT needs ethyca/codegraph added to its repo scope. App secrets are already available at org level.

[JadeCara]

Closing — we're switching to a 4-hour snapshot schedule in codegraph instead of per-commit repository_dispatch triggers. Simpler and avoids cross-repo PAT scope requirements.