From 5f75f2072265138dd0ba6d331485ea94ac414f37 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 00:10:53 +0000
Subject: [PATCH 1/9] Initial plan


From f6e31a951294c5d47b4701fb5546514a88de7101 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 00:17:47 +0000
Subject: [PATCH 2/9] Add reusable generated-file regeneration workflows

Co-authored-by: xiang17 <9310587+xiang17@users.noreply.github.com>
---
 .github/workflows/pull-request-helper.yml     |  68 +--------
 .../workflows/regenerate-generated-files.yml  |  75 ++++++++++
 .../reusable-regenerate-generated-files.yml   | 131 ++++++++++++++++++
 CONTRIBUTING.md                               |  10 ++
 4 files changed, 223 insertions(+), 61 deletions(-)
 create mode 100644 .github/workflows/regenerate-generated-files.yml
 create mode 100644 .github/workflows/reusable-regenerate-generated-files.yml

diff --git a/.github/workflows/pull-request-helper.yml b/.github/workflows/pull-request-helper.yml
index b26be60ece8..7b1c452cfe5 100644
--- a/.github/workflows/pull-request-helper.yml
+++ b/.github/workflows/pull-request-helper.yml
@@ -4,68 +4,14 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   pull-request-helper:
     if: github.event.pull_request.user.login == 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # this is the personal access token used for "git push" below
-          # which is needed in order to trigger workflows
-          token: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          ref: ${{ github.event.pull_request.head.ref }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
-        with:
-          cache-read-only: true
-
-      - name: Set git user
-        run: |
-          git config user.name github-actions[bot]
-          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-
-      # - name: Spotless
-      #   env:
-      #     NUMBER: ${{ github.event.issue.number }}
-      #   run: |
-      #     ./gradlew spotlessApply
-      #     if git diff --quiet; then
-      #       exit 0 # success
-      #     fi
-      #     git commit -a -m "./gradlew spotlessApply"
-
-      - name: Update license report
-        env:
-          NUMBER: ${{ github.event.issue.number }}
-        run: |
-          ./gradlew generateLicenseReport
-          git add licenses
-          # there's always going to one line difference due to the timestamp included in the report
-          if [[ $(git diff --cached --shortstat licenses) == " 1 file changed, 1 insertion(+), 1 deletion(-)" ]]
-          then
-            git reset HEAD licenses
-            git checkout -- licenses
-            exit 0 # success
-          fi
-          git commit -m "./gradlew generateLicenseReport"
-
-      - name: Update lock files
-        env:
-          NUMBER: ${{ github.event.issue.number }}
-        run: |
-          ./gradlew resolveAndLockAll --write-locks
-          git add "*.lockfile"
-          if git diff --cached --quiet; then
-            exit 0 # success
-          fi
-          git commit -m "./gradlew resolveAndLockAll --write-locks"
-
-      - name: Push
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          git push
+    uses: ./.github/workflows/reusable-regenerate-generated-files.yml
+    with:
+      pr_number: ${{ github.event.pull_request.number }}
+      skip_if_contains_main: false
+    secrets:
+      PR_HELPER_GITHUB_TOKEN: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
diff --git a/.github/workflows/regenerate-generated-files.yml b/.github/workflows/regenerate-generated-files.yml
new file mode 100644
index 00000000000..4717f67a95c
--- /dev/null
+++ b/.github/workflows/regenerate-generated-files.yml
@@ -0,0 +1,75 @@
+name: Regenerate generated files
+
+on:
+  push:
+    branches:
+      - main
+  issue_comment:
+    types:
+      - created
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: Pull request number to process
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  prepare-targets:
+    if: github.event_name != 'issue_comment' || (github.event.issue.pull_request != null && startsWith(github.event.comment.body, '/regen'))
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.targets.outputs.matrix }}
+    steps:
+      - name: Determine target pull requests
+        id: targets
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          ISSUE_PR_NUMBER: ${{ github.event.issue.number }}
+          GH_TOKEN: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          WORKFLOW_DISPATCH_PR_NUMBER: ${{ inputs.pr_number }}
+        run: |
+          set -euo pipefail
+
+          if [[ "$EVENT_NAME" == "push" ]]; then
+            prs=$(gh pr list --repo "$REPO" --state open --label dependencies --json number,headRepository)
+            matrix=$(echo "$prs" | jq -c '[.[] | {pr: .number}]')
+          elif [[ "$EVENT_NAME" == "issue_comment" ]]; then
+            matrix=$(jq -cn --argjson pr "$ISSUE_PR_NUMBER" '[{pr:$pr}]')
+          elif [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
+            if [[ -z "$WORKFLOW_DISPATCH_PR_NUMBER" ]]; then
+              echo "No workflow_dispatch pr_number provided, skipping"
+              matrix='[]'
+            else
+              matrix=$(jq -cn --argjson pr "$WORKFLOW_DISPATCH_PR_NUMBER" '[{pr:$pr}]')
+            fi
+          else
+            echo "Unsupported event: $EVENT_NAME"
+            exit 1
+          fi
+
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
+
+  regenerate-generated-files:
+    needs:
+      - prepare-targets
+    if: needs.prepare-targets.outputs.matrix != '[]'
+    strategy:
+      fail-fast: false
+      max-parallel: 3
+      matrix:
+        include: ${{ fromJson(needs.prepare-targets.outputs.matrix) }}
+    concurrency:
+      group: regen-${{ matrix.pr }}
+      cancel-in-progress: true
+    uses: ./.github/workflows/reusable-regenerate-generated-files.yml
+    with:
+      pr_number: ${{ matrix.pr }}
+      skip_if_contains_main: true
+    secrets:
+      PR_HELPER_GITHUB_TOKEN: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
diff --git a/.github/workflows/reusable-regenerate-generated-files.yml b/.github/workflows/reusable-regenerate-generated-files.yml
new file mode 100644
index 00000000000..c9bae86a473
--- /dev/null
+++ b/.github/workflows/reusable-regenerate-generated-files.yml
@@ -0,0 +1,131 @@
+name: Reusable - Regenerate generated files
+
+on:
+  workflow_call:
+    inputs:
+      pr_number:
+        type: number
+        required: true
+      skip_if_contains_main:
+        type: boolean
+        required: false
+        default: true
+    secrets:
+      PR_HELPER_GITHUB_TOKEN:
+        required: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  regenerate-generated-files:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve PR head branch
+        id: pr
+        env:
+          GH_TOKEN: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
+          PR_NUMBER: ${{ inputs.pr_number }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          pr_json=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefName,headRepository)
+          head_repo=$(echo "$pr_json" | jq -r '.headRepository.nameWithOwner // ""')
+          head_ref=$(echo "$pr_json" | jq -r '.headRefName')
+
+          echo "head_repo=$head_repo" >> "$GITHUB_OUTPUT"
+          echo "head_ref=$head_ref" >> "$GITHUB_OUTPUT"
+
+          if [[ "$head_repo" != "$REPO" ]]; then
+            echo "eligible=false" >> "$GITHUB_OUTPUT"
+            echo "Skipping PR #$PR_NUMBER from fork repository: $head_repo"
+          else
+            echo "eligible=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout PR head
+        if: steps.pr.outputs.eligible == 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # this personal access token is required so pushes retrigger workflows
+          token: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
+          repository: ${{ steps.pr.outputs.head_repo }}
+          ref: ${{ steps.pr.outputs.head_ref }}
+          fetch-depth: 0
+
+      - name: Setup Gradle
+        if: steps.pr.outputs.eligible == 'true'
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        with:
+          cache-read-only: true
+
+      - name: Set git user
+        if: steps.pr.outputs.eligible == 'true'
+        run: |
+          git config user.name github-actions[bot]
+          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+
+      - name: Merge main and regenerate generated files
+        if: steps.pr.outputs.eligible == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
+          PR_NUMBER: ${{ inputs.pr_number }}
+          REPO: ${{ github.repository }}
+          SKIP_IF_CONTAINS_MAIN: ${{ inputs.skip_if_contains_main }}
+        run: |
+          set -euo pipefail
+
+          git fetch origin main
+
+          if [[ "$SKIP_IF_CONTAINS_MAIN" == "true" ]] && git merge-base --is-ancestor origin/main HEAD; then
+            echo "PR #$PR_NUMBER already contains origin/main, skipping"
+            exit 0
+          fi
+
+          git merge --no-edit origin/main || true
+
+          mapfile -t conflicted < <(git diff --name-only --diff-filter=U)
+
+          if [ ${#conflicted[@]} -gt 0 ]; then
+            generated=()
+            real=()
+
+            for f in "${conflicted[@]}"; do
+              case "$f" in
+                *gradle.lockfile|licenses/more-licenses.md) generated+=("$f") ;;
+                *)                                        real+=("$f") ;;
+              esac
+            done
+
+            if [ ${#real[@]} -gt 0 ]; then
+              printf 'genuine conflict, aborting: %s\n' "${real[@]}"
+
+              comment=$'Auto-regeneration stopped because this PR has genuine merge conflicts in non-generated files:\n\n'
+              for f in "${real[@]}"; do
+                comment+="- \`$f\`"$'\n'
+              done
+              comment+=$'\nPlease resolve these conflicts manually, then rerun `/regen` if needed.'
+
+              gh pr comment "$PR_NUMBER" --repo "$REPO" --body "$comment"
+              git merge --abort
+              exit 0
+            fi
+
+            for f in "${generated[@]}"; do
+              git checkout --ours -- "$f"
+              git add -- "$f"
+            done
+          fi
+
+          if [ -f .git/MERGE_HEAD ]; then
+            git commit --no-edit
+          fi
+
+          ./gradlew resolveAndLockAll --write-locks
+          ./gradlew generateLicenseReport --no-build-cache
+
+          git add -A -- '*.lockfile' licenses
+          git diff --cached --quiet || git commit -m "regenerate lock files and license report"
+          git push
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6df87810fed..c4c02cf96da 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -51,6 +51,16 @@ After updating dependencies, regenerate the license report to include licenses f
 
 This ensures all third-party licenses are properly documented.
 
+### Automatic regeneration for dependency pull requests
+
+Generated files (`**/gradle.lockfile` and `licenses/more-licenses.md`) are automatically refreshed by GitHub Actions:
+
+- On each push to `main`, open dependency PRs are merged with `main` and regenerated automatically.
+- On an individual PR, comment `/regen` to run the regeneration workflow on demand.
+- `pull-request-helper.yml` continues to refresh generated files for newly opened Dependabot PRs.
+
+If regeneration detects merge conflicts in non-generated source files (`.kts`, `.java`, `.toml`, workflows, etc.), the bot leaves a PR comment and stops. In that case, resolve those source conflicts manually and rerun `/regen` if needed.
+
 ## IntelliJ setup and troubleshooting
 
 See [IntelliJ setup and troubleshooting](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/docs/contributing/intellij-setup-and-troubleshooting.md)

From 4673d5786251a138abf426301d1430743c66573c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 00:19:06 +0000
Subject: [PATCH 3/9] Harden regen workflow issue comment trigger

Co-authored-by: xiang17 <9310587+xiang17@users.noreply.github.com>
---
 .github/workflows/regenerate-generated-files.yml          | 2 +-
 .github/workflows/reusable-regenerate-generated-files.yml | 1 +
 CONTRIBUTING.md                                           | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/regenerate-generated-files.yml b/.github/workflows/regenerate-generated-files.yml
index 4717f67a95c..a4376a511d1 100644
--- a/.github/workflows/regenerate-generated-files.yml
+++ b/.github/workflows/regenerate-generated-files.yml
@@ -20,7 +20,7 @@ permissions:
 
 jobs:
   prepare-targets:
-    if: github.event_name != 'issue_comment' || (github.event.issue.pull_request != null && startsWith(github.event.comment.body, '/regen'))
+    if: github.event_name != 'issue_comment' || (github.event.issue.pull_request != null && startsWith(github.event.comment.body, '/regen') && github.event.issue.user.login == 'dependabot[bot]' && (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'COLLABORATOR'))
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.targets.outputs.matrix }}
diff --git a/.github/workflows/reusable-regenerate-generated-files.yml b/.github/workflows/reusable-regenerate-generated-files.yml
index c9bae86a473..66230bffd31 100644
--- a/.github/workflows/reusable-regenerate-generated-files.yml
+++ b/.github/workflows/reusable-regenerate-generated-files.yml
@@ -20,6 +20,7 @@ permissions:
 
 jobs:
   regenerate-generated-files:
+    if: github.event_name != 'issue_comment' || (github.event.issue.user.login == 'dependabot[bot]' && (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'COLLABORATOR'))
     runs-on: ubuntu-latest
     steps:
       - name: Resolve PR head branch
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c4c02cf96da..40d935fe6a0 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -56,7 +56,7 @@ This ensures all third-party licenses are properly documented.
 Generated files (`**/gradle.lockfile` and `licenses/more-licenses.md`) are automatically refreshed by GitHub Actions:
 
 - On each push to `main`, open dependency PRs are merged with `main` and regenerated automatically.
-- On an individual PR, comment `/regen` to run the regeneration workflow on demand.
+- On an individual Dependabot PR, a repository member can comment `/regen` to run the regeneration workflow on demand.
 - `pull-request-helper.yml` continues to refresh generated files for newly opened Dependabot PRs.
 
 If regeneration detects merge conflicts in non-generated source files (`.kts`, `.java`, `.toml`, workflows, etc.), the bot leaves a PR comment and stops. In that case, resolve those source conflicts manually and rerun `/regen` if needed.

From 0f15ff7c95767227d4b80deb01619f855690d3ca Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 00:19:49 +0000
Subject: [PATCH 4/9] Use immutable PR SHA for regeneration checkout

Co-authored-by: xiang17 <9310587+xiang17@users.noreply.github.com>
---
 .../workflows/reusable-regenerate-generated-files.yml    | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/reusable-regenerate-generated-files.yml b/.github/workflows/reusable-regenerate-generated-files.yml
index 66230bffd31..79c0ee93dea 100644
--- a/.github/workflows/reusable-regenerate-generated-files.yml
+++ b/.github/workflows/reusable-regenerate-generated-files.yml
@@ -32,12 +32,14 @@ jobs:
         run: |
           set -euo pipefail
 
-          pr_json=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefName,headRepository)
+          pr_json=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefName,headRefOid,headRepository)
           head_repo=$(echo "$pr_json" | jq -r '.headRepository.nameWithOwner // ""')
           head_ref=$(echo "$pr_json" | jq -r '.headRefName')
+          head_sha=$(echo "$pr_json" | jq -r '.headRefOid')
 
           echo "head_repo=$head_repo" >> "$GITHUB_OUTPUT"
           echo "head_ref=$head_ref" >> "$GITHUB_OUTPUT"
+          echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
 
           if [[ "$head_repo" != "$REPO" ]]; then
             echo "eligible=false" >> "$GITHUB_OUTPUT"
@@ -53,7 +55,7 @@ jobs:
           # this personal access token is required so pushes retrigger workflows
           token: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
           repository: ${{ steps.pr.outputs.head_repo }}
-          ref: ${{ steps.pr.outputs.head_ref }}
+          ref: ${{ steps.pr.outputs.head_sha }}
           fetch-depth: 0
 
       - name: Setup Gradle
@@ -75,6 +77,7 @@ jobs:
           PR_NUMBER: ${{ inputs.pr_number }}
           REPO: ${{ github.repository }}
           SKIP_IF_CONTAINS_MAIN: ${{ inputs.skip_if_contains_main }}
+          HEAD_REF: ${{ steps.pr.outputs.head_ref }}
         run: |
           set -euo pipefail
 
@@ -129,4 +132,4 @@ jobs:
 
           git add -A -- '*.lockfile' licenses
           git diff --cached --quiet || git commit -m "regenerate lock files and license report"
-          git push
+          git push origin "HEAD:$HEAD_REF"

From 64b1e54d4fec9d20956a5cd88d4017bf3459f2a1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 00:20:34 +0000
Subject: [PATCH 5/9] Route /regen comments through workflow dispatch

Co-authored-by: xiang17 <9310587+xiang17@users.noreply.github.com>
---
 .../workflows/regenerate-generated-files.yml  | 20 +++++++++++++++----
 .../reusable-regenerate-generated-files.yml   |  1 -
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/regenerate-generated-files.yml b/.github/workflows/regenerate-generated-files.yml
index a4376a511d1..418e0c2ace2 100644
--- a/.github/workflows/regenerate-generated-files.yml
+++ b/.github/workflows/regenerate-generated-files.yml
@@ -19,8 +19,23 @@ permissions:
   pull-requests: write
 
 jobs:
+  dispatch-regeneration-request:
+    if: github.event_name == 'issue_comment' && github.event.issue.pull_request != null && startsWith(github.event.comment.body, '/regen') && github.event.issue.user.login == 'dependabot[bot]' && (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'COLLABORATOR')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger workflow_dispatch for target pull request
+        env:
+          GH_TOKEN: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          gh workflow run regenerate-generated-files.yml \
+            --repo "$REPO" \
+            --ref main \
+            -f pr_number="$PR_NUMBER"
+
   prepare-targets:
-    if: github.event_name != 'issue_comment' || (github.event.issue.pull_request != null && startsWith(github.event.comment.body, '/regen') && github.event.issue.user.login == 'dependabot[bot]' && (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'COLLABORATOR'))
+    if: github.event_name != 'issue_comment'
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.targets.outputs.matrix }}
@@ -29,7 +44,6 @@ jobs:
         id: targets
         env:
           EVENT_NAME: ${{ github.event_name }}
-          ISSUE_PR_NUMBER: ${{ github.event.issue.number }}
           GH_TOKEN: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
           REPO: ${{ github.repository }}
           WORKFLOW_DISPATCH_PR_NUMBER: ${{ inputs.pr_number }}
@@ -39,8 +53,6 @@ jobs:
           if [[ "$EVENT_NAME" == "push" ]]; then
             prs=$(gh pr list --repo "$REPO" --state open --label dependencies --json number,headRepository)
             matrix=$(echo "$prs" | jq -c '[.[] | {pr: .number}]')
-          elif [[ "$EVENT_NAME" == "issue_comment" ]]; then
-            matrix=$(jq -cn --argjson pr "$ISSUE_PR_NUMBER" '[{pr:$pr}]')
           elif [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
             if [[ -z "$WORKFLOW_DISPATCH_PR_NUMBER" ]]; then
               echo "No workflow_dispatch pr_number provided, skipping"
diff --git a/.github/workflows/reusable-regenerate-generated-files.yml b/.github/workflows/reusable-regenerate-generated-files.yml
index 79c0ee93dea..e75b018cef3 100644
--- a/.github/workflows/reusable-regenerate-generated-files.yml
+++ b/.github/workflows/reusable-regenerate-generated-files.yml
@@ -20,7 +20,6 @@ permissions:
 
 jobs:
   regenerate-generated-files:
-    if: github.event_name != 'issue_comment' || (github.event.issue.user.login == 'dependabot[bot]' && (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'COLLABORATOR'))
     runs-on: ubuntu-latest
     steps:
       - name: Resolve PR head branch

From a40a4523a6df3166e760310e19ee35a95f012a31 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 00:21:11 +0000
Subject: [PATCH 6/9] Gate regen matrix job away from issue comments

Co-authored-by: xiang17 <9310587+xiang17@users.noreply.github.com>
---
 .github/workflows/regenerate-generated-files.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/regenerate-generated-files.yml b/.github/workflows/regenerate-generated-files.yml
index 418e0c2ace2..837982d51b3 100644
--- a/.github/workflows/regenerate-generated-files.yml
+++ b/.github/workflows/regenerate-generated-files.yml
@@ -70,7 +70,7 @@ jobs:
   regenerate-generated-files:
     needs:
       - prepare-targets
-    if: needs.prepare-targets.outputs.matrix != '[]'
+    if: github.event_name != 'issue_comment' && needs.prepare-targets.outputs.matrix != '[]'
     strategy:
       fail-fast: false
       max-parallel: 3

From 6252d4cf91ce03265a3ab4b6682abc9fe1636afb Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 00:21:46 +0000
Subject: [PATCH 7/9] Limit regen execution to push and dispatch events

Co-authored-by: xiang17 <9310587+xiang17@users.noreply.github.com>
---
 .github/workflows/regenerate-generated-files.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/regenerate-generated-files.yml b/.github/workflows/regenerate-generated-files.yml
index 837982d51b3..733cc59d9d0 100644
--- a/.github/workflows/regenerate-generated-files.yml
+++ b/.github/workflows/regenerate-generated-files.yml
@@ -35,7 +35,7 @@ jobs:
             -f pr_number="$PR_NUMBER"
 
   prepare-targets:
-    if: github.event_name != 'issue_comment'
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.targets.outputs.matrix }}
@@ -70,7 +70,7 @@ jobs:
   regenerate-generated-files:
     needs:
       - prepare-targets
-    if: github.event_name != 'issue_comment' && needs.prepare-targets.outputs.matrix != '[]'
+    if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && needs.prepare-targets.outputs.matrix != '[]'
     strategy:
       fail-fast: false
       max-parallel: 3

From 74763b047279ceb5d6860c9cbaf2c9a461a645c5 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 00:22:26 +0000
Subject: [PATCH 8/9] Scope regen workflow permissions by job

Co-authored-by: xiang17 <9310587+xiang17@users.noreply.github.com>
---
 .github/workflows/regenerate-generated-files.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/regenerate-generated-files.yml b/.github/workflows/regenerate-generated-files.yml
index 733cc59d9d0..54cbd814edb 100644
--- a/.github/workflows/regenerate-generated-files.yml
+++ b/.github/workflows/regenerate-generated-files.yml
@@ -15,8 +15,8 @@ on:
         type: string
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
+  pull-requests: read
 
 jobs:
   dispatch-regeneration-request:
@@ -71,6 +71,9 @@ jobs:
     needs:
       - prepare-targets
     if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && needs.prepare-targets.outputs.matrix != '[]'
+    permissions:
+      contents: write
+      pull-requests: write
     strategy:
       fail-fast: false
       max-parallel: 3

From f40432c10bfbadf83b21f8419a21e7f5355faf55 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 00:23:14 +0000
Subject: [PATCH 9/9] Dispatch regen work through dedicated runner workflow

Co-authored-by: xiang17 <9310587+xiang17@users.noreply.github.com>
---
 .../regenerate-generated-files-runner.yml     | 22 ++++++++++++++++++
 .../workflows/regenerate-generated-files.yml  | 23 +++++++++++--------
 2 files changed, 35 insertions(+), 10 deletions(-)
 create mode 100644 .github/workflows/regenerate-generated-files-runner.yml

diff --git a/.github/workflows/regenerate-generated-files-runner.yml b/.github/workflows/regenerate-generated-files-runner.yml
new file mode 100644
index 00000000000..6b652d54e38
--- /dev/null
+++ b/.github/workflows/regenerate-generated-files-runner.yml
@@ -0,0 +1,22 @@
+name: Regenerate generated files runner
+
+on:
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: Pull request number to process
+        required: true
+        type: number
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  regenerate-generated-files:
+    uses: ./.github/workflows/reusable-regenerate-generated-files.yml
+    with:
+      pr_number: ${{ inputs.pr_number }}
+      skip_if_contains_main: true
+    secrets:
+      PR_HELPER_GITHUB_TOKEN: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
diff --git a/.github/workflows/regenerate-generated-files.yml b/.github/workflows/regenerate-generated-files.yml
index 54cbd814edb..d8668148f8f 100644
--- a/.github/workflows/regenerate-generated-files.yml
+++ b/.github/workflows/regenerate-generated-files.yml
@@ -29,7 +29,7 @@ jobs:
           PR_NUMBER: ${{ github.event.issue.number }}
           REPO: ${{ github.repository }}
         run: |
-          gh workflow run regenerate-generated-files.yml \
+          gh workflow run regenerate-generated-files-runner.yml \
             --repo "$REPO" \
             --ref main \
             -f pr_number="$PR_NUMBER"
@@ -71,9 +71,6 @@ jobs:
     needs:
       - prepare-targets
     if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && needs.prepare-targets.outputs.matrix != '[]'
-    permissions:
-      contents: write
-      pull-requests: write
     strategy:
       fail-fast: false
       max-parallel: 3
@@ -82,9 +79,15 @@ jobs:
     concurrency:
       group: regen-${{ matrix.pr }}
       cancel-in-progress: true
-    uses: ./.github/workflows/reusable-regenerate-generated-files.yml
-    with:
-      pr_number: ${{ matrix.pr }}
-      skip_if_contains_main: true
-    secrets:
-      PR_HELPER_GITHUB_TOKEN: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger workflow_dispatch for target pull request
+        env:
+          GH_TOKEN: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
+          PR_NUMBER: ${{ matrix.pr }}
+          REPO: ${{ github.repository }}
+        run: |
+          gh workflow run regenerate-generated-files-runner.yml \
+            --repo "$REPO" \
+            --ref main \
+            -f pr_number="$PR_NUMBER"