ci: refresh popular.json inline in deploy workflow

.github/AGENTS.md

@@ -6,9 +6,8 @@ See [AGENTS.md](../AGENTS.md) at the repo root for full project documentation.
 
 | Workflow | Trigger | Purpose |
 |----------|---------|---------|
-| `deploy.yml` | Push to `main` | Build + deploy to GitHub Pages |
+| `deploy.yml` | Push to `main`, daily cron, manual | Refresh `popular.json` from App Insights, build, deploy to GitHub Pages |
 | `preview.yml` | PR events | Validate, build with PR-scoped base, post preview URL |
-| `update-popular.yml` | Daily cron | Query App Insights, commit updated `popular.json` |
 
 ## PR Checklist
 

.github/workflows/deploy.yml

@@ -3,10 +3,15 @@ name: Deploy to GitHub Pages
 on:
   push:
     branches: [main]
+  schedule:
+    # Daily redeploy at 06:00 UTC so popular notebooks data stays fresh
+    # without a separate workflow opening pull requests.
+    - cron: "0 6 * * *"
   workflow_dispatch:
 
 permissions:
   contents: write
+  id-token: write # Required for Azure OIDC federated credential
 
 concurrency:
   group: "gh-pages-deploy"
@@ -24,12 +29,37 @@ jobs:
         with:
           node-version: 22
           cache: npm
-          cache-dependency-path: site/package-lock.json
+          cache-dependency-path: |
+            site/package-lock.json
+            scripts/package-lock.json
 
-      - name: Install dependencies
+      - name: Install site dependencies
         working-directory: ./site
         run: npm ci
 
+      - name: Install script dependencies
+        working-directory: ./scripts
+        run: npm ci
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Refresh popular notebooks data from App Insights
+        id: refresh-popular
+        continue-on-error: true
+        working-directory: ./scripts
+        env:
+          APP_INSIGHTS_RESOURCE_ID: ${{ vars.APP_INSIGHTS_RESOURCE_ID }}
+        run: npx tsx fetch-popular.ts
+
+      - name: Warn if popular data refresh failed
+        if: steps.refresh-popular.outcome == 'failure'
+        run: echo "::warning::App Insights refresh failed — building with the committed site/src/data/popular.json fallback."
+
       - name: Build site
         working-directory: ./site
         env:

.github/workflows/update-popular.yml → .github/workflows/validate-popular-fetch.yml

@@ -1,18 +1,19 @@
-name: Update Popular Notebooks
+name: Validate Popular Fetch
+
+# Manual-only diagnostic that exercises Azure OIDC login and the
+# App Insights query used by deploy.yml to refresh popular.json.
+# Does not build the site, does not deploy, and does not write to the
+# repository — it just proves the credentials and query work end to end.
 
 on:
-  schedule:
-    # Runs daily at 06:00 UTC
-    - cron: "0 6 * * *"
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
-  id-token: write  # Required for OIDC federated credential
+  contents: read
+  id-token: write # Required for Azure OIDC federated credential
 
 jobs:
-  fetch-popular:
+  validate:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -42,15 +43,8 @@ jobs:
           APP_INSIGHTS_RESOURCE_ID: ${{ vars.APP_INSIGHTS_RESOURCE_ID }}
         run: npx tsx fetch-popular.ts
 
-      - name: Create pull request for updated popular data
-        uses: peter-evans/create-pull-request@v8
-        with:
-          add-paths: site/src/data/popular.json
-          branch: chore/update-popular-notebooks
-          delete-branch: true
-          commit-message: "chore: update popular notebooks data"
-          title: "chore: update popular notebooks data"
-          body: |
-            Automated update of `site/src/data/popular.json` from Application Insights click data.
-
-            This PR is opened by the scheduled Update Popular Notebooks workflow so `main` can remain protected.
+      - name: Show fetched popular.json
+        run: |
+          echo "::group::site/src/data/popular.json"
+          cat site/src/data/popular.json
+          echo "::endgroup::"

AGENTS.md

@@ -25,7 +25,7 @@ forgebook/
 │       └── styles/      # global.css (Tailwind v4)
 │   └── tests/           # Playwright e2e tests
 ├── scripts/             # validate-registry.ts, fetch-popular.ts
-└── .github/workflows/   # CI: deploy, preview, update-popular
+└── .github/workflows/   # CI: deploy (also refreshes popular.json), preview
 ```
 
 ## Setup Commands
@@ -73,8 +73,9 @@ cd site && npm run build                      # Full build with type checking
 - Two groups: Core Capabilities (agents, inference, evaluation, etc.) and Integrations (langchain, mcp, etc.)
 
 ### Popular Notebooks
-- `site/src/data/popular.json` is auto-generated by CI (daily cron via App Insights click data)
-- **Never edit popular.json manually** — it gets overwritten
+- `site/src/data/popular.json` is refreshed by `deploy.yml` (on every push to `main`, on the daily 06:00 UTC cron, and on manual dispatch) by querying App Insights click data via OIDC.
+- The committed copy is a fallback: if the App Insights query fails, the build logs a warning and reuses the last good `popular.json` so the deploy never breaks on a transient telemetry outage.
+- **Never edit popular.json manually** — it gets overwritten on the next deploy.
 - Homepage shows "Most Popular" section only when ≥12 recipes exist
 
 ## Registry Format
@@ -122,9 +123,8 @@ cd site && npm run build                      # Full build with type checking
 
 | Workflow | Trigger | Purpose |
 |----------|---------|---------|
-| `deploy.yml` | Push to `main` | Build + deploy to GitHub Pages |
+| `deploy.yml` | Push to `main`, daily cron, manual | Refresh `popular.json` from App Insights, build, deploy to GitHub Pages |
 | `preview.yml` | PR events | Validate, build with PR-scoped base, post preview URL |
-| `update-popular.yml` | Daily cron | Query App Insights, commit updated `popular.json` |
 
 ## Telemetry