fix(ci): flag a refresh with an issue, not a pull request

.github/workflows/refresh-derived.yml

@@ -4,8 +4,13 @@
 # contributor's build never depends on a third party being reachable.
 #
 # This is the reconciliation half. It runs on a schedule, re-reads every
-# publisher repository, and opens a pull request when the facts have moved.
-# Nothing here publishes anything: a human still reviews the diff and merges.
+# publisher repository, and pushes a branch when the facts have moved.
+#
+# It does not open the pull request itself. The organization does not allow
+# GitHub Actions to create pull requests, and that is a setting worth keeping,
+# so the job opens an issue linking to the compare view instead. Opening the
+# pull request from there is one click. Nothing here publishes anything: a
+# human still reviews the diff and merges.
 name: Refresh derived listing facts
 
 on:
@@ -17,7 +22,7 @@ on:
 
 permissions:
   contents: write
-  pull-requests: write
+  issues: write
 
 concurrency:
   group: refresh-derived
@@ -47,14 +52,14 @@ jobs:
         run: pnpm generate
 
       # Diagnostic only. If a publisher has deleted their licence or repository,
-      # an active listing becomes invalid — which is exactly when this pull
-      # request needs to be opened, not suppressed. The pull request's own CI
-      # reports the failure to whoever reviews it.
+      # an active listing becomes invalid — which is exactly when this needs to
+      # be flagged, not suppressed. The pull request's own CI reports the
+      # failure to whoever reviews it.
       - name: Report how the refreshed facts validate
         continue-on-error: true
         run: pnpm validate:addons
 
-      - name: Open a pull request if anything moved
+      - name: Push the refreshed facts and flag them for review
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -64,6 +69,9 @@ jobs:
           fi
 
           branch="chore/refresh-derived-facts"
+          title="Community listing facts have moved"
+          summary="$(git diff --stat)"
+
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
@@ -81,26 +89,38 @@ jobs:
           git commit -m "chore(addons): refresh derived listing facts"
           git push "$lease" origin "$branch"
 
-          if gh pr view "$branch" --json state --jq .state 2>/dev/null | grep -q OPEN; then
-            echo "Existing pull request updated."
-            exit 0
-          fi
+          compare="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/compare/$branch?expand=1"
 
           {
-            echo "Scheduled re-read of every community publisher's repository."
-            echo
-            echo "Something changed on their side: a licence added or removed, a"
+            echo "A scheduled re-read of every community publisher's repository found"
+            echo "that something moved on their side: a licence added or removed, a"
             echo "repository renamed or made private, an addon rebuilt against a"
             echo "different SDK."
             echo
+            echo '```'
+            echo "$summary"
+            echo '```'
+            echo
+            echo "The refreshed facts are pushed to \`$branch\`."
+            echo
+            echo "**[Open the pull request]($compare)**"
+            echo
             echo "Review the diff before merging. A listing may now qualify to be"
-            echo "published, or may have stopped qualifying."
+            echo "published, or may have stopped qualifying. Merging is not the whole"
+            echo "job: the website builds from its own committed snapshot, so it needs"
+            echo 'a `pnpm sync:addons` afterwards to pick this up.'
             echo
-            echo "Generated by .github/workflows/refresh-derived.yml."
-          } > /tmp/pr-body.md
-
-          gh pr create \
-            --base main \
-            --head "$branch" \
-            --title "chore(addons): refresh derived listing facts" \
-            --body-file /tmp/pr-body.md
+            echo 'Generated by `.github/workflows/refresh-derived.yml`.'
+          } > /tmp/issue-body.md
+
+          # One issue per outstanding refresh, not one per week.
+          existing="$(gh issue list --state open --limit 100 --json number,title \
+            --jq '.[] | [.number, .title] | @tsv' \
+            | awk -F'\t' -v t="$title" '$2 == t { print $1; exit }')"
+
+          if [ -n "$existing" ]; then
+            gh issue comment "$existing" --body-file /tmp/issue-body.md
+            echo "Updated issue #$existing."
+          else
+            gh issue create --title "$title" --body-file /tmp/issue-body.md
+          fi