[dpristovnik-veza]

Backports upstream benc-uk/workflow-dispatch benc-uk#103 (pin the REST API version). Every dispatch from cookieai-core currently logs:

[@octokit/request] "POST .../actions/workflows/<wf>/dispatches" is deprecated. It is scheduled to be removed on Fri, 10 Mar 2028

That's because requests without a version header get 2022-11-28.

Changes:

• src/main.ts: both client constructions (token and GitHub App) send x-github-api-version: 2026-03-10 on every request through an Octokit hook.before. That includes apps.listInstallations, workflow listing, runs, jobs, logs and artifacts. Per GitHub's 2026-03-10 breaking-changes list, none of those endpoints change.
• src/workflow-handler.ts: drops return_run_details, which is removed in 2026-03-10. The dispatch endpoint now always returns 200 with workflow_run_id / html_url, which the existing code already reads, and the polling fallback stays.
• dist/index.js rebuilt with npm run build.
• .github/workflows/build-test.yaml, retrieve-logs.yml: all 34 action refs pinned to commit SHAs. The org requires SHA pins, and Build & Test has failed at startup since 2026-09-28 because of it. The actions/* SHAs reuse the cookieai-core pins. nick-invision/assert-action v3.0.0 is 22dd2a6. mikeal/publish-to-github-action is pinned to its current master e5a27bb (last change 2020).

Other upstream changes since the fork were reviewed and are already here (benc-uk#77 path matching, benc-uk#79 PR ref default, benc-uk#49 disabled workflows) or not needed (benc-uk#97 pending status, since our wait loop runs until completed; benc-uk#112, since our input parser already throws; benc-uk#98, since we have wait-for-completion-interval).

Testing:

• Read-only calls with the hook: GitHub reports x-github-api-version-selected: 2026-03-10; paginated workflow listing and run listing work.
• Dispatched echo-1.yaml on this branch with the hook: 200, no deprecation header, workflow_run_id and html_url present.
• Build & Test on this branch: build passes. Every test job fails with 401 Bad credentials from the PERSONAL_TOKEN secret (last updated 2026-03-31). That token needs rotating, or the tests moved to the GitHub App, before the suite can run.

Note: #9 also rebuilds dist/index.js. Whichever merges second needs a rebase and npm run build.