#1370 · stacks/buddy

Part of #1367 (Phase 0 — Foundation).

Problem

The dependency dashboard renders interactive controls that are entirely decorative — nothing consumes them:

Per-PR rebase checkboxes  (src/dashboard/dashboard-generator.ts:109-145) — no code reads rebase-branch= anywhere
"Rebase all open PRs" checkbox — marker rebase-all-open-prs never consumed
Footer "run again" checkbox  (dashboard-generator.ts:421) — never consumed
Pinning is broken end-to-end: the generated workflow computes PIN but never appends it to the CLI invocation (src/setup.ts:1534-1560); the dashboard command types a pin?: boolean option but never registers a --pin flag (bin/cli.ts:593); unpinIssue targets a REST endpoint that can't pin (src/git/github-provider.ts:1553-1563)

Renovate's dashboard checkboxes work; ours only look like they do. (This also covers the dashboard half of #108 — deprecated deps are already rendered but the interaction layer is missing.)

Spec

1. Checkbox consumption

Add dashboard-checkbox detection to the update-check flow (bin/cli.ts:896) and to the unified workflow's issues: [edited] trigger:

New src/dashboard/dashboard-actions.ts: parseDashboardActions(body: string): { rebaseBranches: string[], rebaseAll: boolean, manualRun: boolean } — a checked box is - [x] preceding the marker comment
For each checked rebase-branch=<branch>: resolve the open PR for that branch and run the same rebase path as the PR-body checkbox (reuse checkAndUpdatePRsWithRebaseCheckbox logic, src/utils/helpers.ts:499)
rebase-all-open-prs: iterate all open Buddy Bot PRs
manual job: trigger a full scan+update run
After acting, uncheck the boxes by rewriting the issue body (same pattern as PR checkbox unchecking)

2. Workflow trigger

generateUnifiedWorkflow (src/setup.ts) must add issues: { types: [edited] } to the trigger block, guarded to the dashboard issue (title/label match + bot-actor loop guard identical to the PR pull_request: [edited] guard).

3. Pinning

Register --pin on the dashboard command; pass through from workflow input (fix src/setup.ts:1534-1560 to append the flag)
Implement pin/unpin via GraphQL (pinIssue / unpinIssue mutations — REST cannot pin); replace the broken REST attempt in github-provider.ts:1553-1563
Pin by default when dashboard.pin is true in config (add to src/types.ts — README documents pin: true but the type lacks it)

Tasks

src/dashboard/dashboard-actions.ts + types
Wire into update-check and workflow issues: [edited] trigger
Uncheck-after-action body rewriting with race guard (compare updated_at / use conditional update)
GraphQL pin/unpin in github-provider.ts; --pin flag; workflow passthrough fix
dashboard.pin config option + validation + docs
Tests: parse/uncheck round-trip, rebase-all fan-out, manual-job trigger, pin mutation (mocked), loop-guard (bot edits must not re-trigger)

Acceptance criteria

Checking a PR's box on the dashboard rebases that PR within one update-check cycle and the box unchecks itself
"Rebase all" updates every open Buddy Bot PR; "run again" kicks a scan
buddy-bot dashboard --pin pins the issue; config dashboard.pin: true pins on creation
No workflow trigger loops (bot's own issue edits are ignored)

Dependencies

#1368 (manifest) recommended for resolving branch→PR→updates without regex
Related existing issue: #108 (deprecated dependencies surfacing)