From 5503c198ba979e8d7d5e669389580d69f44eea3a Mon Sep 17 00:00:00 2001
From: Maksim Burtsev <zadrot-lol@list.ru>
Date: Sun, 23 Aug 2026 20:19:00 +0400
Subject: [PATCH] ci: stop the demo workflow pushing to master
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two bugs, both mine.

The workflow committed the rendered GIF straight to master. The master ruleset
requires changes to go through a pull request, so the push was rejected with
GH013 and the job went red on every run.

Second, the check it used to decide whether to push could never be false: VHS
renders the migration filename from the current timestamp, so the bytes differ
on every run. Even with the push working, this would have churned a 175K binary
into git history on every trigger.

The GIF is a yearly-ish manual update, not something worth automating into the
default branch. The workflow now renders the tape and uploads the result as an
artifact — it verifies the tape still works and hands you a fresh GIF to commit
through a normal PR. Dropped contents: write, it no longer needs it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/demo.yml | 23 ++++++++++++-----------
 demo/demo.tape             |  7 ++++++-
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/demo.yml b/.github/workflows/demo.yml
index a3a11a3..711b9d2 100644
--- a/.github/workflows/demo.yml
+++ b/.github/workflows/demo.yml
@@ -13,7 +13,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   render:
@@ -68,14 +68,15 @@ jobs:
         with:
           path: demo/demo.tape
 
-      - name: Commit GIF
+      - name: Upload GIF
+        uses: actions/upload-artifact@v7
+        with:
+          name: demo-gif
+          path: assets/demo.gif
+          if-no-files-found: error
+
+      - name: Summary
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add assets/demo.gif
-          if git diff --staged --quiet; then
-            echo "GIF unchanged"
-          else
-            git commit -m "chore: regenerate demo GIF [skip ci]"
-            git push
-          fi
+          echo "Rendered \`assets/demo.gif\` (\`$(du -h assets/demo.gif | cut -f1)\`)." >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "Download it from the **demo-gif** artifact above, drop it into \`assets/\`, and open a PR to update the README GIF." >> "$GITHUB_STEP_SUMMARY"
diff --git a/demo/demo.tape b/demo/demo.tape
index ba1b46b..927d374 100644
--- a/demo/demo.tape
+++ b/demo/demo.tape
@@ -1,6 +1,11 @@
 # Demo GIF for the README.
 #
-# Rendered in CI by .github/workflows/demo.yml. To render locally:
+# The committed assets/demo.gif is rendered from this tape by hand and updated
+# through a normal pull request. .github/workflows/demo.yml renders the tape on
+# demand and uploads the result as an artifact, so you can check that the tape
+# still works and download a fresh GIF without recording anything.
+#
+# To render locally:
 #
 #   docker compose -f docker-compose.test.yml up -d --wait
 #   uv sync --dev && export PATH="$PWD/.venv/bin:$PATH"