[MetzinAround]

Copilot Generated

Summary

• Start the website's deploy.yml workflow when app changes reach badger/home/main, including fixes to existing app code.
• Limit the push trigger to badge/apps/** and provide a manual retry. No release or tag is needed.
• Use a short-lived GitHub App installation token limited to Actions write on badger/badger.github.io.
• Keep the lasting key in the catalog-sync environment. The job does not check out or execute app code and has no default token permissions.

Related: badger/badger.github.io#50. This is the companion sender for badger/badger.github.io#55.

Validation

• git diff --check passes.
• actionlint 1.7.12 validates this sender and both affected website workflows without diagnostics.
• Exact pinned App-token metadata and bounded workflow contract checks pass, including the supported client-id input and restricted target.
• GitHub CodeQL checks pass.
• Live dispatch requires the receiving website workflow on main and the GitHub App/environment setup.

Required setup and order

Merge badger/badger.github.io#55 before enabling this sender. Create a dedicated organization-owned GitHub App installed only on the website repository with Actions read/write permission.

A repository administrator must configure the catalog-sync environment to allow only the main branch and add:

• Environment variable: CATALOG_APP_CLIENT_ID (the public App Client ID, not an OAuth secret).
• Environment secret: CATALOG_APP_PRIVATE_KEY (upload directly from the private-key file; do not paste it into chat, code, or logs).

Protect workflow changes through review. Do not grant content-write or administration permission, install the App across all repositories, or remove the environment restriction to work around missing access.

Automatic updates remain unverified until a real source-to-website run succeeds. This PR does not change badge app code or create generated-data commits.

[MetzinAround]

@copilot update this branch so we can safely merge it into main soon.

[Copilot]

@copilot update this branch so we can safely merge it into main soon.

Merged current main into the branch and pushed merge commit f063949. The branch is now up to date; 59 targeted tests passed and fresh analysis checks are queued. The PR still needs those checks to finish before it’s ready to merge.

[Copilot]

🟢 Approval recommended

No blocking issues remain; live operation still requires the documented receiver merge, administrator setup, and end-to-end validation.

No open issues 🎉

What changed in this PR

Adds a sender workflow so changes to badge apps on badger/home/main trigger a website catalog deployment without requiring a release or tag.

Changes:

• Runs on pushes affecting badge/apps/**, with a manual retry option.
• Dispatches the website’s deploy.yml workflow on main.
• Uses a short-lived, repository-scoped GitHub App token with Actions write permission and credentials from the catalog-sync environment.

File	Description
.github/​workflows/​update-website-catalog.yml	Adds the app-change trigger and authenticated website deployment dispatch.

_{Review effort: Balanced}