feat(slides): automated homepage highlights refresh

.github/workflows/refresh-highlights.yml

@@ -0,0 +1,101 @@
+name: Refresh Highlights
+
+on:
+  schedule:
+    - cron: '0 7 * * 1'   # Mon ~08:00 Europe/Oslo (UTC; ±1h DST drift)
+    - cron: '0 15 * * 5'  # Fri ~16:00 Europe/Oslo
+  workflow_dispatch:
+
+concurrency:
+  group: refresh-highlights
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install
+
+      - name: Install OpenCode (pinned; agent is optional)
+        continue-on-error: true
+        run: npm install -g opencode-ai@0.5.29
+
+      - name: Run refresh pipeline
+        id: refresh
+        continue-on-error: true
+        env:
+          # Optional: set repo secrets to enable the caption agent. Absent → the
+          # pipeline uses summary-derived captions (fully functional).
+          SLIDES_AGENT_MODEL: ${{ vars.SLIDES_AGENT_MODEL }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+        run: node scripts/slides/refresh.mjs --diff-scope
+
+      - name: Build sanity gate
+        id: build
+        if: steps.refresh.outcome == 'success' && steps.refresh.outputs.result == 'changed'
+        continue-on-error: true
+        run: pnpm build
+        env:
+          GITHUB_PAGES: true
+
+      - name: Open PR and merge
+        id: pr
+        if: steps.refresh.outputs.result == 'changed' && steps.build.outcome == 'success'
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.SLIDES_BOT_TOKEN || github.token }}
+        run: |
+          set -euo pipefail
+          BRANCH="bot/slides-refresh-${{ github.run_id }}"
+          git config user.name "elixir-no-bot"
+          git config user.email "actions@github.com"
+          git checkout -b "$BRANCH"
+          git add src/data/slides.json src/data/slides
+          git commit -m "chore(slides): refresh homepage highlights"
+          git push origin "$BRANCH"
+          PR_URL=$(gh pr create --base main --head "$BRANCH" \
+            --title "chore(slides): refresh homepage highlights" \
+            --body "Automated highlights refresh. Slide selection and captions were regenerated from recent content; validation and build passed.")
+          # The workflow already ran validation + pnpm build as its own gate, so
+          # merge immediately with --admin (deterministic, no waiting on pr-test,
+          # which does not run for GITHUB_TOKEN-created PRs). A failure here is
+          # loud: continue-on-error keeps the run going so the issue is opened.
+          gh pr merge "$PR_URL" --squash --admin --delete-branch
+
+      - name: Report failure
+        if: steps.refresh.outcome == 'failure' || steps.build.outcome == 'failure' || steps.pr.outcome == 'failure'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          TITLE="Highlights refresh failed"
+          BODY="The scheduled highlights refresh failed on run ${{ github.run_id }}. See the [workflow logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})."
+          EXISTING=$(gh issue list --label slides-bot --state open --json number --jq '.[0].number // empty' || echo "")
+          if [ -n "$EXISTING" ]; then
+            gh issue comment "$EXISTING" --body "$BODY"
+          else
+            gh label create slides-bot --color BFD4F2 --description "Automated highlights refresh" 2>/dev/null || true
+            gh issue create --title "$TITLE" --label slides-bot --body "$BODY"
+          fi
+
+      - name: Fail job if pipeline, build, or merge failed
+        if: steps.refresh.outcome == 'failure' || steps.build.outcome == 'failure' || steps.pr.outcome == 'failure'
+        run: exit 1

package.json

@@ -15,7 +15,10 @@
     "astro": "astro",
     "postbuild": "pagefind --site dist",
     "test:slugs": "node scripts/check-slugs.mjs",
-    "test:pages": "node scripts/test-pages.mjs"
+    "test:pages": "node scripts/test-pages.mjs",
+    "slides:collect": "node scripts/slides/collect-candidates.mjs",
+    "slides:refresh": "node scripts/slides/refresh.mjs",
+    "slides:validate": "node scripts/slides/validate-slides.mjs"
   },
   "dependencies": {
     "@astrojs/check": "^0.9.0",
@@ -46,6 +49,7 @@
     "@types/dompurify": "^3.2.0",
     "@types/react": "^18.2.37",
     "@types/react-dom": "^18.2.15",
+    "gray-matter": "^4.0.3",
     "npm-run-all2": "^9.0.2",
     "pagefind": "^1.5.0"
   },

scripts/slides/README.md

@@ -0,0 +1,41 @@
+# Slides automation
+
+Keeps `src/data/slides.json` (the homepage highlights carousel) fresh via a
+twice-weekly GitHub Actions job. Canonical data lives in `src/data/slides.json`
+and `src/data/slides/`; `public/data/slides/` is gitignored and regenerated at
+build by `src/plugins/content-assets.mjs`. Never edit `public/`.
+
+## Ownership tags
+
+Every slide entry carries exactly one signal:
+
+- `"evergreen": true`, pinned. Always kept, text frozen, image never deleted by
+  the bot. Set this to protect a slide.
+- `"sourceArticle": "collection/year/slug"`, bot-managed. Scored from that
+  article each run; rotated by recency + editorial weight; dropped when it ages
+  out. `funding-and-projects` refs have two segments (no year).
+- Neither key, treated as evergreen (fail closed) and logged. Should not occur
+  after bootstrap.
+
+Bot-created image files are named `<year>-<slug>.<ext>`. The bot only ever
+deletes files matching `^\d{4}-[a-z0-9-]+\.(png|jpe?g|webp)$` that are no longer
+referenced and belonged to a `sourceArticle` entry, so legacy/human files
+(none start with a 4-digit year) are structurally safe.
+
+## CMS interaction
+
+The `/admin` SlidesEditor seeds its form with `useState({ ...slide })` and edits
+only `alt`/`caption`/`src`, so `sourceArticle`/`evergreen` survive both editing
+and reordering. Ownership keys are preserved end to end; no action required.
+
+## Operator commands
+
+- `pnpm slides:collect`, print the ranked candidate pool + current state (dry).
+- `pnpm slides:refresh`, run the full pipeline locally (writes files).
+- `pnpm slides:validate`, run the sanity gate against the working tree.
+- `bash scripts/manage-slides.sh`, interactive manual editor (unchanged).
+
+The GitHub workflow `.github/workflows/refresh-highlights.yml` runs the pipeline
+on cron (Mon 07:00 UTC, Fri 15:00 UTC) and on manual dispatch, then opens a PR
+and auto-merges. On any hard failure it opens/updates one `slides-bot`-labelled
+issue instead of merging.