[Alejandro Lopez (soyalejolopez)]

Category

• New resource (script, agent, guide, analytics, skill)
• Update to an existing resource
• Bug fix
• Docs, site, or tooling

What's in this pull request?

Stops the Build catalog workflow from pushing a branch and opening a pull request after it rebuilds the catalog.

master requires pull requests, and the repository blocks GitHub Actions from opening them. After every merge the workflow's direct push was rejected, it pushed a catalog-refresh/... branch it could never turn into a PR, and the run failed (for example, #564's run). Nothing was lost, but each merge showed a red X and left a stray branch.

What changed

• build-catalog.yml: the publish step still tries a direct push, so it keeps working if the policy changes or a bypass is configured. When the push is rejected, it no longer creates a branch or calls gh pr. It prints a warning and writes the out-of-date files and the rebuild command to the run summary, and the run succeeds. It also drops the pull-requests: write permission and the GH_TOKEN it no longer needs.
• test-traffic-workflow.js: a regression check that the publish step does not open pull requests, does not fail on a rejected push, and does not request pull-requests access.
• tools/catalog-build/README.md: a Publishing changes section with the manual steps (build, render the social card for new resources, rebuild, commit generated files in the PR).
• CHANGELOG.md: a line for the change.

How it was tested

I ran the extracted step in a throwaway repository against two remotes. With a remote that rejects the push, it exits 0, creates no branch, and writes the summary. With a remote that accepts the push, it commits and pushes as before.

Not changed: the weekly traffic workflow still opens its pull request with AUTOMATION_PAT and fails loudly with a compare link when it cannot. That failure is the reminder to open the weekly PR, so it is left alone.

Related issues

Part of the revamp tracked in #482.

Checklist

• No private, customer-specific, or unlicensed content, and no secrets
• README front matter is valid: npm ci --prefix tools/catalog-build && npm run check --prefix tools/catalog-build (passes: metadata valid for 58 resources, internal links resolve, all tests pass)
• version and updated were bumped (not applicable: no resource changed)
• Installation and usage steps were tested (simulated both push outcomes, see above)
• Files over 5 MB were avoided

See CONTRIBUTING.md for details.