From f1a42bbf7a24dd353b9dcf86c0be9a4f1aee9655 Mon Sep 17 00:00:00 2001
From: sepo-agent <279869237+sepo-agent@users.noreply.github.com>
Date: Thu, 13 Aug 2026 03:17:07 +0000
Subject: [PATCH 1/2] Trigger canonical deploy on repo visibility changes

---
 .github/workflows/agent-deploy-site-main.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.github/workflows/agent-deploy-site-main.yml b/.github/workflows/agent-deploy-site-main.yml
index af1ba72..8f4dff7 100644
--- a/.github/workflows/agent-deploy-site-main.yml
+++ b/.github/workflows/agent-deploy-site-main.yml
@@ -4,6 +4,20 @@ on:
   push:
     branches: [main]
   workflow_dispatch:
+  # A repository visibility flip (public <-> private) must refresh the
+  # canonical deployment. The preview-api re-derives repo identity from the
+  # OIDC token and re-reads GitHub's current visibility on every canonical
+  # deploy, rewriting both the preview-registry record (isPrivate) and the R2
+  # META (visibility). Without this trigger those snapshots only update on the
+  # next push to main, so a newly-private site stays publicly served until then.
+  #
+  # Exposure window: a privatized redeploy runs the full rebuild
+  # (npm ci -> build -> upload -> deploy), which takes minutes, during which
+  # the previously-public deployment keeps being served. This rebuild path is
+  # not fail-closed; a lightweight "flip the snapshot first, then rebuild"
+  # visibility-refresh route is a tracked follow-up.
+  repository:
+    types: [publicized, privatized]
 
 permissions:
   id-token: write
@@ -19,6 +33,11 @@ concurrency:
 
 jobs:
   deploy:
+    # repository (publicized/privatized) events fire against the default
+    # branch, so github.ref is refs/heads/main and this guard accepts them
+    # alongside push and workflow_dispatch while still deploying only main.
+    # The concurrency group above also keys on github.ref, so a visibility
+    # event shares the canonical-site group and cancel-in-progress behavior.
     if: vars.AGENT_ENABLED != 'false' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:

From a10e1ba2a16b26e212ed2bae0132b39c493e04b8 Mon Sep 17 00:00:00 2001
From: sepo-agent <279869237+sepo-agent@users.noreply.github.com>
Date: Thu, 13 Aug 2026 03:36:55 +0000
Subject: [PATCH 2/2] Use public: event for publicize; defer privatize to #31

---
 .github/workflows/agent-deploy-site-main.yml | 34 +++++++++-----------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/agent-deploy-site-main.yml b/.github/workflows/agent-deploy-site-main.yml
index 8f4dff7..a5a9b2f 100644
--- a/.github/workflows/agent-deploy-site-main.yml
+++ b/.github/workflows/agent-deploy-site-main.yml
@@ -4,20 +4,18 @@ on:
   push:
     branches: [main]
   workflow_dispatch:
-  # A repository visibility flip (public <-> private) must refresh the
-  # canonical deployment. The preview-api re-derives repo identity from the
-  # OIDC token and re-reads GitHub's current visibility on every canonical
-  # deploy, rewriting both the preview-registry record (isPrivate) and the R2
-  # META (visibility). Without this trigger those snapshots only update on the
-  # next push to main, so a newly-private site stays publicly served until then.
+  # A private->public visibility flip must refresh the canonical deployment.
+  # The preview-api re-derives repo identity from the OIDC token and re-reads
+  # GitHub's current visibility on every canonical deploy, rewriting both the
+  # preview-registry record (isPrivate) and the R2 META (visibility). Without a
+  # trigger those snapshots only update on the next push to main, so a
+  # newly-public repo stays behind the private-site gate until then.
   #
-  # Exposure window: a privatized redeploy runs the full rebuild
-  # (npm ci -> build -> upload -> deploy), which takes minutes, during which
-  # the previously-public deployment keeps being served. This rebuild path is
-  # not fail-closed; a lightweight "flip the snapshot first, then rebuild"
-  # visibility-refresh route is a tracked follow-up.
-  repository:
-    types: [publicized, privatized]
+  # `public` is the only repository-visibility transition GitHub Actions exposes
+  # as an `on:` event; it fires on private->public only and takes no `types`.
+  # The reverse public->private (privatize) transition has NO native Actions
+  # trigger and is NOT covered here -- it is tracked separately in #31.
+  public:
 
 permissions:
   id-token: write
@@ -33,11 +31,11 @@ concurrency:
 
 jobs:
   deploy:
-    # repository (publicized/privatized) events fire against the default
-    # branch, so github.ref is refs/heads/main and this guard accepts them
-    # alongside push and workflow_dispatch while still deploying only main.
-    # The concurrency group above also keys on github.ref, so a visibility
-    # event shares the canonical-site group and cancel-in-progress behavior.
+    # The public (private->public) event fires against the default branch, so
+    # github.ref is refs/heads/main and this guard accepts it alongside push
+    # and workflow_dispatch while still deploying only main. The concurrency
+    # group above also keys on github.ref, so a visibility event shares the
+    # canonical-site group and cancel-in-progress behavior.
     if: vars.AGENT_ENABLED != 'false' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps: