Four GitHub Apps were reachable under three different key suffixes
(_PRIVATE_KEY, _KEY_, _SECRET) and their ids sat half in secrets, half
in variables. Each app now reads <APP>_ID from variables and
<APP>_PRIVATE_KEY from secrets:
vars.APP_ID / secrets.APP_PRIVATE_KEY -> GHAPP_HEADERS_*
secrets.APP_{ID,KEY}_APPROVE_AND_MERGE -> GHAPP_MERGEBOT_*
vars.PUSH_MAIN_APP_ID / secrets.PUSH_MAIN_APP_SECRET -> GHAPP_SYNC_*
secrets.PB_BOT_APP_{ID,PRIVATE_KEY} -> GHAPP_PBBOT_*
Values that are not credentials become variables, so a failing run shows
what it talked to instead of ***:
secrets.POCKETBASE_URL -> vars.POCKETBASE_URL
secrets.POCKETBASE_COLLECTION -> vars.POCKETBASE_COLLECTION
secrets.FRONTEND_URL -> vars.FRONTEND_URL (also replaces vars.SITE_URL)
The frontend endpoints shared three secrets where two suffice. Cache
revalidation and screenshot import have the same blast radius and merge;
the advisory ingest keeps its own secret because it feeds the update
helper on user systems:
REVALIDATE_SECRET, SCREENSHOT_IMPORT_SECRET -> FRONTEND_INGEST_SECRET
BREAKING_CHANGE_INGEST_SECRET -> FRONTEND_ADVISORY_SECRET
PAT_MICHEL ties infrastructure to one person and existed at both org and
repo level, so the repo copy silently shadowed the org one; it becomes
GH_CROSS_REPO_TOKEN.
* Bump GitHub Actions across workflows
Update workflow dependencies to newer major versions in repository automation files. This upgrades `actions/checkout` to v7, `actions/github-script` to v9, `actions/create-github-app-token` to v3, and GitHub Pages actions (`upload-pages-artifact` and `deploy-pages`) to v5 to keep CI/CD and maintenance workflows current.
* add dependabot for gh actions
Compute today's date once and use a consolidated patchBody for PATCH requests (including last_update_commit from PR_URL/COMMIT_URL). Add logic to promote dev scripts on merge: if record.is_dev === true, set is_dev to false and script_created to today, and log the promotion. Replace the previous duplicated date construction with the new patchBody.
