feat(google): Google Sheets sync — credentials, keychain, opt-in gate, existing-sheet push

.github/workflows/redeploy-site-on-release.yml

@@ -1,24 +1,24 @@
 name: Redeploy site on release publish
 
-# The releases page (on the `site` branch) is rendered at build time, so it only
-# reflects releases that existed when it was last built. `release` events fire
-# only for workflows on the default branch, so this lives on `main` and simply
-# triggers the site's own deploy workflow over on the `site` branch.
+# The releases page is rendered at build time, so it only reflects releases that
+# existed when it was last built. `release` events fire only for workflows on the
+# default branch, so this lives on `main`.
+#
+# The site is built by Cloudflare Workers Builds, which triggers on a commit to
+# `site` — and publishing a release makes no commit anywhere. Without this the
+# site simply goes stale, with nothing failing to say so.
 on:
   release:
     types: [published]
   workflow_dispatch:
 
-permissions:
-  actions: write # needed to dispatch another workflow
-
 jobs:
   trigger:
     runs-on: ubuntu-latest
     steps:
-      - name: Trigger site deploy
-        # --repo is required: this job has no checkout, so gh can't infer the
-        # repository from a local git remote.
-        run: gh workflow run deploy-site.yml --ref site --repo "${{ github.repository }}"
+      - name: Trigger the Cloudflare build
+        # -f, or curl exits 0 on a 404 and this job stays green having done
+        # nothing — which is the failure this workflow exists to prevent.
+        run: curl -fsS -X POST "$HOOK"
         env:
-          GH_TOKEN: ${{ github.token }}
+          HOOK: ${{ secrets.CLOUDFLARE_DEPLOY_HOOK }}

.github/workflows/release.yml

@@ -19,6 +19,10 @@ env:
   # the repo. Absent (any local build): the Google Sheets export reports it isn't configured.
   QRATE_GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
   QRATE_GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+  # Sent to the credential endpoint. It ships inside the binary, so it turns away casual scraping
+  # and nothing more — see docs/site-oauth-handoff.md. Absent: the endpoint answers 401 and the
+  # app carries on with the pair above.
+  QRATE_GOOGLE_CONFIG_TOKEN: ${{ secrets.GOOGLE_CONFIG_TOKEN }}
 
 jobs:
   # ---------------------------------------------------------------------------

.gitignore

@@ -17,3 +17,7 @@ GEMINI.md
 
 # The Islandora plugin is its own repository, checked out here so a dev build loads it.
 plugins/islandora/
+
+# The OAuth client JSON Google hands you. Named here because the download lands with this shape
+# and a stray copy in the repo root is the easiest way to publish it by accident.
+client_secret_*.json