Publishing

A merge to main that touches a post or an image asks consolelabs/console-apps
to rebuild and deploy log.console.so. .github/workflows/main.yml, “Publish on
push”, does the asking: it mints a console-ops-bot GitHub App token and calls
the GitHub REST API to dispatch console-apps’ publish-log.yml workflow. That
workflow builds the site from this repo’s main and deploys the Cloudflare
Worker cl-log. The full chain, including why the App holds actions:write
instead of contents:write, is consolelabs/console-apps docs/publish-pipeline.md.

The dead secret: CONSOLE_PAT

CONSOLE_PAT was the personal access token this workflow used before the
console-ops-bot App existed. Its last read was dropped in #16, when the org
turned off GitHub-hosted runners and the old log.console.so GitHub Pages
dispatch leg went with it.

Deleted 2026-09-05, at the log.console.so soak verdict, with
gh secret delete CONSOLE_PAT --repo consolelabs/content. The repository now
holds CONSOLE_OPS_BOT_APP_ID and CONSOLE_OPS_BOT_PRIVATE_KEY and nothing
else.

The verdict that released it is consolelabs/console-apps
docs/verification/log-cut.md, ## Soak verdict. consolelabs/log.console.so
is archived and its GitHub Pages site no longer claims the hostname, so no
rollback path reads this token any more.