ci(demo): open a reviewable PR instead of pushing the demo GIF

.github/workflows/demo.yml

@@ -13,6 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      pull-requests: write
 
     steps:
       - name: Checkout repository
@@ -35,7 +36,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y ffmpeg ttyd
-          VHS_VERSION="$(curl -fsSL https://api.github.com/repos/charmbracelet/vhs/releases/latest | jq -r '.tag_name')"
+          VHS_VERSION="$(curl -fsSL -H "Authorization: Bearer ${{ secrets.GH_PAT }}" https://api.github.com/repos/charmbracelet/vhs/releases/latest | jq -r '.tag_name')"
           ARCH="$(dpkg --print-architecture)"
 
           case "$ARCH" in
@@ -60,15 +61,60 @@ jobs:
       - name: Record demo
         run: pnpm demo:record
 
-      - name: Commit and push demo GIF
+      - name: Open pull request with demo GIF
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT }}
+          GIF_PATH: docs/demo/interactive-upgrade.gif
+          PR_BRANCH: automated-demo-gif
         run: |
-          if git diff --quiet -- docs/demo/interactive-upgrade.gif; then
-            echo "No demo GIF changes to commit"
+          set -euo pipefail
+
+          if git diff --quiet -- "$GIF_PATH"; then
+            echo "No demo GIF changes to publish."
+            exit 0
+          fi
+
+          git config user.email "${{ secrets.GH_EMAIL }}"
+          git config user.name "${{ secrets.GH_USERNAME }}"
+
+          # Preserve the freshly recorded GIF, then branch cleanly off main so
+          # the pull request contains only the GIF change (regardless of which
+          # branch this workflow was dispatched from).
+          cp "$GIF_PATH" "$RUNNER_TEMP/demo.gif"
+          git fetch origin main
+          git checkout -f -B "$PR_BRANCH" origin/main
+          mkdir -p "$(dirname "$GIF_PATH")"
+          cp "$RUNNER_TEMP/demo.gif" "$GIF_PATH"
+          git add "$GIF_PATH"
+
+          if git diff --cached --quiet; then
+            echo "Recorded GIF is identical to the one on main; nothing to publish."
             exit 0
           fi
 
-          git config --local user.email "${{ secrets.GH_EMAIL }}"
-          git config --local user.name "${{ secrets.GH_USERNAME }}"
-          git add docs/demo/interactive-upgrade.gif
           git commit -m "docs: update demo gif"
-          git push
+          git push --force origin "$PR_BRANCH"
+
+          BODY_FILE="$RUNNER_TEMP/pr-body.md"
+          {
+            printf '%s\n\n' "Automated demo recording from \`${{ github.ref_name }}\` (run [#${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}))."
+            printf '%s\n\n' "Review the recording below before merging to \`main\`:"
+            printf '%s\n\n' "![inup demo](https://raw.githubusercontent.com/${{ github.repository }}/${PR_BRANCH}/${GIF_PATH})"
+            printf '%s\n' "_Generated by the Record Demo workflow._"
+          } > "$BODY_FILE"
+
+          if gh pr view "$PR_BRANCH" --json state --jq '.state' 2>/dev/null | grep -qx OPEN; then
+            PR_URL="$(gh pr view "$PR_BRANCH" --json url --jq '.url')"
+            gh pr edit "$PR_BRANCH" --body-file "$BODY_FILE"
+            echo "Updated existing PR: $PR_URL"
+          else
+            PR_URL="$(gh pr create \
+              --base main \
+              --head "$PR_BRANCH" \
+              --title "docs: update demo gif" \
+              --body-file "$BODY_FILE")"
+            echo "Opened PR: $PR_URL"
+          fi
+
+          echo "### Demo PR ready" >> "$GITHUB_STEP_SUMMARY"
+          echo "$PR_URL" >> "$GITHUB_STEP_SUMMARY"