Route gallery proposals through Copilot issues

.github/workflows/audit-gallery-content.yml

@@ -46,6 +46,10 @@ jobs:
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      contents: read
+      pull-requests: read
+      copilot-requests: write
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
@@ -79,15 +83,6 @@ jobs:
             exit 1
           }
 
-      - name: Prepare per-run automation branch
-        env:
-          UPDATE_BRANCH: automation/gallery-content-updates-${{ github.run_id }}-${{ github.run_attempt }}
-        run: |
-          git config user.name "gallery-content-automation"
-          git config user.email "gallery-content-automation@users.noreply.github.com"
-          git fetch origin main
-          git checkout -b "$UPDATE_BRANCH" origin/main
-
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: 22
@@ -121,52 +116,41 @@ jobs:
           node -e "const fs=require('fs');const value=fs.readFileSync(process.env.RUNNER_TEMP + '/copilot-skills.json','utf8');for(const name of ['cosmosdb-best-practices','humanizer'])if(!value.includes(name))throw new Error('Required Copilot skill unavailable: '+name)"
 
       - name: Classify and promote high-confidence updates
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
-          if [ "${{ secrets.COPILOT_GITHUB_TOKEN != '' }}" != "true" ]; then
-            echo "Copilot classification skipped: COPILOT_GITHUB_TOKEN is not configured."
-            exit 0
-          fi
-          COPILOT_GITHUB_TOKEN="${{ secrets.COPILOT_GITHUB_TOKEN }}" node scripts/gallery-audit/index.mjs --classify-only --promote
+          node scripts/gallery-audit/index.mjs --classify-only --promote
 
       - name: Validate proposed catalog
         if: hashFiles('output/gallery-content-review/promotion-result.json') != ''
         run: |
           npm run test:gallery-audit
           npm run build
 
-      - name: Detect catalog changes
-        id: changes
+      - name: Detect actionable recommendations
+        id: actionable
         shell: bash
         run: |
-          if git diff --quiet -- static/templates.json static/retired-templates.json; then
-            echo "catalog=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "catalog=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Publish draft pull request
-        if: success()
-        env:
-          GH_TOKEN: ${{ secrets.GALLERY_UPDATE_TOKEN }}
-          UPDATE_BRANCH: automation/gallery-content-updates-${{ github.run_id }}-${{ github.run_attempt }}
-          NOTIFY_REVIEWER: jagord_microsoft
-        run: |
-          test -n "$GH_TOKEN" || { echo "GALLERY_UPDATE_TOKEN is required to publish the draft pull request."; exit 1; }
-          gh auth setup-git
-
           if [ ! -f output/gallery-content-review/promotion-result.json ]; then
-            echo "No complete promotion result; leaving the existing draft pull request unchanged."
-            exit 0
-          fi
-
-          if [ "${{ steps.changes.outputs.catalog }}" != "true" ]; then
+            echo "available=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          count=$(node -p "const r=require('./output/gallery-content-review/promotion-result.json'); (r.additions?.length ?? 0) + (r.updates?.length ?? 0) + (r.retirements?.length ?? 0)")
+          test "$count" -gt 0 || { echo "available=false" >> "$GITHUB_OUTPUT"; exit 0; }
+          git diff --quiet -- static/templates.json static/retired-templates.json && {
+            echo "Actionable recommendations did not produce a catalog diff."
+            exit 1
+          }
+          echo "available=true" >> "$GITHUB_OUTPUT"
 
-          git add static/templates.json static/retired-templates.json
-          git commit -m "chore: refresh gallery content"
-          git push origin "HEAD:$UPDATE_BRANCH"
-          gh pr create --draft --base main --head "$UPDATE_BRANCH" --reviewer "$NOTIFY_REVIEWER" --title "chore: refresh gallery content" --body-file output/gallery-content-review/promotion-summary.md
+      - name: Upload proposal files
+        if: steps.actionable.outputs.available == 'true'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: gallery-content-proposal-${{ github.run_id }}
+          path: output/gallery-content-review/promotion-summary.md
+          retention-days: 30
+          if-no-files-found: error
 
       - name: Add summary
         if: always()

.github/workflows/publish-gallery-proposal.yml

@@ -0,0 +1,65 @@
+name: Publish gallery proposal
+
+on:
+  workflow_run:
+    workflows: [Audit gallery content]
+    types: [completed]
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event != 'pull_request' &&
+      github.event.workflow_run.head_branch == github.event.repository.default_branch
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      actions: read
+      issues: write
+    env:
+      SOURCE_RUN_ID: ${{ github.event.workflow_run.id }}
+    steps:
+      - name: Download validated proposal
+        id: proposal
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          artifact_name="gallery-content-proposal-$SOURCE_RUN_ID"
+          artifact_id=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$SOURCE_RUN_ID/artifacts" \
+            --jq ".artifacts[] | select(.name == \"$artifact_name\") | .id")
+          if [ -z "$artifact_id" ]; then
+            echo "available=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          proposal_dir="$RUNNER_TEMP/gallery-proposal"
+          gh run download "$SOURCE_RUN_ID" --repo "$GITHUB_REPOSITORY" --name "$artifact_name" --dir "$proposal_dir"
+          summary_path=$(find "$proposal_dir" -type f -name promotion-summary.md -print -quit)
+          test -n "$summary_path" || { echo "Validated proposal summary is missing."; exit 1; }
+          echo "summary_path=$summary_path" >> "$GITHUB_OUTPUT"
+          echo "available=true" >> "$GITHUB_OUTPUT"
+
+      - name: Publish proposal issue
+        if: steps.proposal.outputs.available == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SUMMARY_PATH: ${{ steps.proposal.outputs.summary_path }}
+        run: |
+          issue_body="$RUNNER_TEMP/gallery-proposal-issue.md"
+          cat > "$issue_body" <<EOF
+          ## Validated gallery proposal
+
+          The automated gallery audit produced the following validated catalog proposal.
+
+          - [Inspect the source workflow run]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$SOURCE_RUN_ID)
+
+          $(cat "$SUMMARY_PATH")
+
+          ## Copilot task
+
+          Treat the edited issue body as the complete source of truth. Implement exactly the additions, URL updates, retirements, and notes that remain in this issue; ignore deleted recommendations. Modify the catalog files, run \`npm run test:gallery-audit\` and \`npm run build\`, and open a draft pull request to \`main\`. Do not add unrelated changes, approve, merge, or enable automerge.
+          EOF
+          issue_url=$(gh issue create --title "Gallery content proposal $SOURCE_RUN_ID" --body-file "$issue_body")
+          printf 'Proposal issue created: %s\n' "$issue_url" >> "$GITHUB_STEP_SUMMARY"