Automate workflow catalog publication to LibreCodeCoop/.github #12

Parent: #11

Goal

Make github-workflows publish generated organization workflow templates to LibreCodeCoop/.github through reviewable pull requests.

Scope

• detect changes under workflow-templates/;
• copy only publishable catalog artifacts;
• open/update a PR in LibreCodeCoop/.github;
• avoid direct pushes;
• keep github-workflows as the only editing source;
• include useful provenance in the PR body;
• support additions, updates and removals;
• avoid publishing vendored upstream files, patches or implementation-only files.

Acceptance criteria

• a change to a generated template produces a reviewable PR in LibreCodeCoop/.github;
• no-op runs do not create PRs;
• catalog output exactly matches the generated source;
• failures are visible and do not partially publish an inconsistent catalog.

Completed validation

• catalog changes are published through reviewable PRs;
• no-op publication leaves no PR open;
• generated catalog output is restricted by workflow-catalog.json;
• unapproved templates are not published;
• invalid source/catalog state fails before partial publication;
• GitHub App authentication is scoped to LibreCodeCoop/.github.

The first production run surfaced an unapproved release workflow candidate, which led to the explicit catalog allowlist in #36. The follow-up run automatically reconciled and closed the stale catalog PR with zero diff.