web-deploy.yml blog-baseline auto-refresh permanently broken by develop branch protection

[bpamiri]

Problem

The post-merge blog visual-baseline auto-refresh in .github/workflows/web-deploy.yml ("Commit pre-refreshed blog baseline" step, git push origin HEAD:develop at ~line 328) is rejected by the develop branch-protection rule: GH013: Changes must be made through a pull request. All 5 retries fail, so the refreshed web/tests/visual-baselines/blog.png never lands.

Observed concretely after #2896 (commit 0ec62e4d4) published the 4.0.3 release post: develop run 27254568247 pre-refreshed the baseline but could not push it back, leaving the baseline stale on develop. Every subsequent web/**-touching PR (e.g. #2913) then fails the Visual regression check with a deterministic ~60k-pixel diff (the new post card shifting the blog index) until someone refreshes manually.

Impact

Every blog-post merge strands a stale baseline and red-Xes all later web-touching PRs — manual refresh-visual-baselines.yml runs are needed each time. Silent failure mode: the deploy run itself stays green.

Suggested approach

Convert the auto-refresh push to a PR + auto-merge flow, same pattern as refresh-packages-baseline.yml. Note the PAT used must have Pull-requests: write in addition to Contents: write, or the auto-merge step fails silently (prior art: the scoop/homebrew auto-update chain).

Acceptance criteria

• Merging a blog post to develop results in the refreshed blog baseline landing on develop without manual intervention (via auto-merged PR).
• A subsequent web/** PR passes Visual regression without a manual baseline refresh.

Source

Found during the 2026-06-09 framework-review remediation campaign while diagnosing the #2913 Visual-regression failure.

[wheels-bot]

Wheels Bot — Triage

Classified as bug.

Suspected layer

Repo CI infrastructure — .github/workflows/web-deploy.yml (and the sibling refresh-packages-baseline.yml as prior-art reference). This sits outside the framework layer system documented in .ai/wheels/ (model / controller / view / router / middleware / migrator / cli / di / job / mailer / sse / seed / config); the closest analog is config, but the fix is YAML, not CFML.

Fix sketch

Replace the direct git push origin HEAD:develop (~line 328 of .github/workflows/web-deploy.yml, "Commit pre-refreshed blog baseline" step) with the PR + auto-merge pattern already used by .github/workflows/refresh-packages-baseline.yml: create a chore/refresh-blog-baseline-<sha> branch, push the refreshed web/tests/visual-baselines/blog.png to it, gh pr create against develop, then gh pr merge --auto --squash. Confirm the PAT used has Pull-requests: write in addition to Contents: write (the issue calls this out explicitly — the scoop/homebrew chain is prior art for silent failures here). Worth double-checking whether the same direct-push pattern exists elsewhere in web-deploy.yml or other workflows, since branch protection on develop would reject any of them.

Confidence: low

Fix shape is clear and well-described, but it lives outside framework layer docs (CI YAML, not CFML) and requires repo-secret / PAT-scope decisions propose-fix can't safely make — better routed to a human who can verify the PAT has the right scopes.

<!-- wheels-bot:triage:2915 -->
<!-- wheels-bot:triage-class:bug -->