From 19bfe87e0e84e3b00c4b5f80c25a9e516788ac6d Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner <michel.roegl-brunner@htl-braunau.at>
Date: Mon, 24 Aug 2026 10:24:59 +0200
Subject: [PATCH] Notify Helper-Scripts site when a breaking-change PR merges
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On a merged PR labelled "breaking change", POST the PR number to the site's
/api/breaking-changes/ingest endpoint so it can show a temporary advisory on
the affected scripts. Uses pull_request_target (secrets available for fork
PRs) and never checks out PR code — it only forwards the number after merge.
The `labeled` trigger also covers labelling a PR after it has merged.

Requires repo secret BREAKING_CHANGE_INGEST_SECRET (matching the site) and an
optional SITE_URL variable (defaults to https://community-scripts.org).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TFBuZEp142Ei2PAfWqbMXT
---
 .github/workflows/notify-breaking-change.yml | 58 ++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 .github/workflows/notify-breaking-change.yml

diff --git a/.github/workflows/notify-breaking-change.yml b/.github/workflows/notify-breaking-change.yml
new file mode 100644
index 000000000..d00cd2bc0
--- /dev/null
+++ b/.github/workflows/notify-breaking-change.yml
@@ -0,0 +1,58 @@
+name: Notify breaking change
+
+# When a PR labelled "breaking change" is merged, tell the Helper-Scripts site
+# so it can show a temporary advisory on the affected scripts. The site pulls
+# the PR itself and re-verifies it is merged + labelled, so this workflow only
+# has to hand over the PR number.
+#
+# Requires one repo secret:
+#   BREAKING_CHANGE_INGEST_SECRET  — must match the value the site runs with.
+# Site URL is taken from the existing FRONTEND_URL secret, then an optional
+# SITE_URL variable, then a hard default.
+#
+# pull_request_target (not pull_request) so the run has access to the secret
+# even for fork PRs. It is safe here: the job never checks out or runs PR code —
+# it only forwards the number after the PR has merged.
+
+on:
+  pull_request_target:
+    # closed  -> fires on the merge itself
+    # labeled -> fires if the label is added to an already-merged PR
+    types: [closed, labeled]
+
+concurrency:
+  group: notify-breaking-change-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  notify:
+    if: >-
+      github.event.pull_request.merged == true &&
+      contains(github.event.pull_request.labels.*.name, 'breaking change')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify site of breaking change
+        env:
+          INGEST_SECRET: ${{ secrets.BREAKING_CHANGE_INGEST_SECRET }}
+          SITE_URL: ${{ secrets.FRONTEND_URL || vars.SITE_URL || 'https://community-scripts.org' }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          if [ -z "${INGEST_SECRET:-}" ]; then
+            echo "::error::BREAKING_CHANGE_INGEST_SECRET secret is not set."
+            exit 1
+          fi
+          url="${SITE_URL%/}/api/breaking-changes/ingest"
+          echo "Notifying $url for PR #${PR}"
+          status="$(curl -sS -o response.json -w '%{http_code}' \
+            -X POST "$url" \
+            -H "Authorization: Bearer ${INGEST_SECRET}" \
+            -H "Content-Type: application/json" \
+            -d "{\"pr\": ${PR}}")"
+          echo "HTTP $status"
+          cat response.json || true
+          echo
+          if [ "$status" != "200" ]; then
+            echo "::error::ingest endpoint returned HTTP $status"
+            exit 1
+          fi