ci(assets): auto-fix image compression on PRs touching posts/assets/

[wab]

Parent

#32 (asset pipeline migration milestone)

Problem

Future non-tech contributors will add images by dragging files into the repo (or via the planned content-authoring skills). Expecting them to run pnpm install && node scripts/optimize-assets.js --write locally is a non-starter — they don't have Node, won't remember the step, and a missed run silently bloats the new blob store.

Manual compression doesn't scale. The repo needs a guardrail.

What to build

GitHub Action that runs on every PR touching posts/assets/**:

1. Checkout the PR branch with write permission (use a GitHub App token, or actions/checkout with persist-credentials + a PAT, or the built-in GITHUB_TOKEN configured with contents: write and pull-requests: write)
2. pnpm install
3. Run node scripts/optimize-assets.js --write (the generalised script from the sibling follow-up feat(assets): generalise compression script across all asset categories #45)
4. If files changed: commit back to the PR branch with chore(assets): auto-compress images [skip ci], push
5. If nothing changed: exit clean
6. Post a sticky PR comment on first auto-fix with what was compressed and the size delta

Optional but valuable:

• Add a [ci skip-compression] flag in PR body to bypass (escape hatch for intentional high-fidelity originals)
• Cache node_modules to keep the action fast

Acceptance criteria

• .github/workflows/optimize-assets.yml exists, triggers on pull_request paths matching posts/assets/**
• Action commits compressed files back to the PR branch when reduction is non-trivial
• Action is idempotent — second run on the same PR is a no-op
• Sticky PR comment summarises what was compressed (only posted when something changed)
• [ci skip-compression] in PR body bypasses the action
• Action does not loop infinitely on its own commits (use [skip ci] or a path-based guard)

Blocked by

• feat(assets): generalise compression script across all asset categories #45 (the generalised optimize-assets.js — no point wiring CI around a script that only handles team/)

Notes

DX follow-up from #41 — companion to #45. Together they form the non-tech contributor flow: drag image into PR → CI compresses + commits back → reviewer sees the cleaned diff. No local Node setup required.

Same approach could later be extended to: lint frontmatter, validate Zod schemas, check for orphan references — this is the foundation for the broader "asset guardrails" theme.

[wab]

This was generated by AI during triage.

Agent Brief

Category: enhancement
Summary: Add a GitHub Actions workflow that auto-compresses images on PRs touching assets/ by invoking scripts/optimize-assets.js --write and committing the result back to the PR branch.

Current behavior:
The repo has no .github/ directory and no CI at all — this is the first workflow. scripts/optimize-assets.js (from #45) is a manual script: contributors must remember to run pnpm install && node scripts/optimize-assets.js --write locally before opening a PR. For non-tech contributors (the target audience of the content-authoring skills chantier), this is a non-starter — most won't have Node installed.

Desired behavior:
On every pull request that adds or modifies files under assets/**, a workflow:

1. Checks out the PR branch with write access
2. Installs dependencies via pnpm
3. Runs node scripts/optimize-assets.js --write
4. If files changed:
   • Commits the compressed binaries back to the PR branch with message chore(assets): auto-compress images
   • Posts (or updates) a single sticky PR comment summarising what was compressed and the size delta
5. If nothing changed: exits clean, no comment posted
6. The workflow respects a [ci skip-compression] marker in the PR body — when present, the workflow exits early without running the compression (escape hatch for intentionally-high-fidelity originals)

The workflow must be idempotent — re-running on a PR where compression has already been applied is a no-op and produces no new commit.

Key interfaces / contracts:

• Trigger — pull_request event with paths filter on assets/**. Both opened and synchronize types (so it re-runs on subsequent pushes to the PR).

• Permissions — at the job level: contents: write, pull-requests: write. Use the built-in GITHUB_TOKEN — no GitHub App or PAT needed for the MVP. (If non-fork contribution stops being the norm and forks need to be supported, this would need to swap to a GitHub App — call it out in a workflow comment but do not implement that path now.)

• Loop prevention — relies on GitHub's native behaviour: commits made with GITHUB_TOKEN do NOT re-trigger pull_request workflows. No [skip ci] marker needed for this purpose. The [ci skip-compression] PR-body marker is for a different concern (manual opt-out by the contributor) and must be checked independently in an early job step that short-circuits the rest.

• Sticky PR comment — use marocchino/sticky-pull-request-comment (or an equivalent maintained action that supports a stable header to update-in-place across runs). The comment shows: per-file before → after (saved X%) lines and a summary block, mirroring the script's own output format.

• Commit identity — use the default github-actions[bot] identity (name: github-actions[bot], email: 41898282+github-actions[bot]@users.noreply.github.com). Do not use a maintainer's identity.

• pnpm setup — use the standard pnpm/action-setup + actions/setup-node with cache: pnpm. Match the Node major version pinned in package.json if present; otherwise use the latest LTS.

Acceptance criteria:

• A workflow file exists under .github/workflows/ that triggers on pull_request (opened, synchronize) with a paths filter on assets/**
• Job-level permissions are contents: write and pull-requests: write (no broader)
• When the PR body contains [ci skip-compression], the workflow exits cleanly without running the compression step
• When images are compressed, a commit with message chore(assets): auto-compress images is pushed to the PR branch under the github-actions[bot] identity
• A sticky PR comment is created or updated with the per-file before → after (saved X%) lines and a summary; the comment is NOT posted when nothing changed
• Re-running the workflow on the same PR after compression has been applied produces no new commit and no new comment update
• The workflow does NOT loop on its own commits (verifiable by triggering a fresh PR that adds a large image and confirming exactly one auto-compress commit lands)
• One atomic commit with conventional message: ci(assets): auto-compress images on PRs touching assets/

Out of scope:

• GitHub App or PAT-based push (default GITHUB_TOKEN is sufficient for non-fork PRs)
• Support for PRs from forks (Ocobo contributors work on branches in the same repo)
• Linting frontmatter, validating Zod schemas, or running the orphan audit in CI (separate concerns, may be follow-ups in milestone 📝 add hubspot implementation post #3)
• Any change to scripts/optimize-assets.js itself — that is delivered by feat(assets): generalise compression script across all asset categories #45
• Caching strategies beyond the default actions/setup-node/pnpm/action-setup cache
• CODEOWNERS, branch protection, status checks configuration

Blocked by:

• feat(assets): generalise compression script across all asset categories #45 — wiring CI around a script that only handles team/ would be a step backwards. Do not start this issue until scripts/optimize-assets.js exists on main.

[wab]

This was generated by AI during triage.

Clarification — scope the script to changed files via --paths

The workflow must invoke optimize-assets.js with a --paths flag (added in #45) listing only the files actually changed in the PR. Without this, every workflow run re-processes all ~150 files in assets/ (cheap but unnecessary).

Add to "Key interfaces / contracts"

• Changed-files extraction — use tj-actions/changed-files (or equivalent maintained action) to compute the list of files under assets/** that are added or modified in the PR. The list is comma-joined and passed to the script as --paths <list>.
• If the changed-files list is empty (e.g. only deletions, or only non-assets/ files snuck past the trigger filter), the workflow exits early without invoking the script and without posting a comment.

Add to acceptance criteria

• Workflow extracts the list of added/modified files under assets/** for the PR and passes them to optimize-assets.js --paths <list>
• When only deletions touch assets/ (no added/modified files), the workflow exits cleanly without invoking the script
• On a PR adding 1 image, the script's output shows that ONLY that file was considered (not the full asset tree)
• The workflow does NOT walk all of assets/; the --paths flag is always used

Why

Pairs with the --paths flag added to scripts/optimize-assets.js in #45. Together they make the CI "lance seulement sur ce qui change", not "lance sur tout à chaque trigger".

Unchanged: everything else in the original brief.