[mikkel]

What

A new workflow, .github/workflows/patchling-app-deploy.yml. When this repo's docs or package change on main, it asks Cloudflare Pages to redeploy patchling.app. It calls a Pages deploy hook, using one repository secret.

Why this design

• patchling.app is the Cloudflare Pages project patchling. It is Git-connected to 255BITS/patchling main, with no build command, output landing/, and no wrangler or deploy workflow (see that repo's docs/deploy.md). Pages only rebuilds when that repo gets a push.
• The site currently pulls nothing from this repo at build time or at runtime. It only links out to GitHub, PyPI and the docs. So today a redeploy produces the same output. The trigger is still the hook to have: any future build-time content from this repo will flow through without further wiring.
• Alternatives I looked at:
  • repository_dispatch to the JS repo needs a cross-repo PAT plus a new receiving workflow, and Pages still would not rebuild without a push or a hook.
  • Building the py docs into the patchling.app build means a build step in Pages and duplicate hosting (the docs already deploy to gptdiff.255labs.xyz via Deploy Documentation).
  • The deploy hook needs one secret and no change in the JS repo.

Behaviour

• Runs on push to main that touches any of:

  • docs/**, mkdocs.yml, overrides/**
  • README.md, CHANGELOG.md
  • patchling/**, pyproject.toml, setup.py
  • the workflow itself

  It can also be started manually (workflow_dispatch).

• If the secret is missing, it skips with a ::notice:: instead of failing, so merging before setup is safe.

• permissions: {}. It never prints the hook URL; it logs only the HTTP status and the Pages deployment id. It has a 5-minute timeout and 2 curl retries. A newer run supersedes a queued older one.

One-time setup (Mikkel)

1. Cloudflare dashboard: Workers & Pages → patchling → Settings → Builds → Deploy hooks → Add deploy hook. Set the name to patchling-py and the branch to main, then copy the URL.
2. GitHub: 255BITS/patchling-py → Settings → Secrets and variables → Actions → New repository secret. Set the name to CF_PAGES_DEPLOY_HOOK_PATCHLING_APP and the value to the hook URL from step 1.
3. Optional: Actions → "Trigger patchling.app deploy" → Run workflow, then confirm that a new production deployment shows up in Pages.

The hook URL is a credential: anyone holding it can trigger builds. If it leaks, delete and recreate it in step 1.

Tests (local)

• actionlint 1.7.12 with shellcheck 0.11.0 on the new file: clean. Two findings in tests.yml (setup-python@v4 too old, SC2102) were already on main and are untouched here.

• yamllint (default rules, line-length 120): clean.

• Dry run: I extracted the step's script from the YAML and ran it against a local mock hook. No calls went to Cloudflare.

  Case	Result
  secret missing	notice, exit 0
  200 with id	logs the id and writes the step summary, exit 0
  500	error after retries, exit 1
  200 with a non-JSON body	id ?, exit 0

  In every case the URL never appeared in the output.