Generate the privacy page from the app repo's PRIVACY.md

.github/workflows/sync-legal.yml

@@ -0,0 +1,104 @@
+name: Sync legal pages
+
+# The policy text has one home: PRIVACY.md in submersion-app/submersion. This
+# workflow regenerates privacy/index.html from it so the site cannot drift out
+# of step with the app's own policy, which is what happened before: the app
+# repo's policy was rewritten while the published page kept serving a version
+# months out of date. A store listing that links a policy contradicting the
+# app's Data safety declaration is a policy violation, so the drift was not
+# cosmetic.
+#
+# Triggers:
+#   schedule            a daily floor, so a missed dispatch still converges
+#   workflow_dispatch   manual "sync it now"
+#   repository_dispatch the app repo can push a `legal-updated` event to make
+#                       a policy change land here within a minute
+#   push                template or renderer changes regenerate immediately
+#
+# The push trigger cannot loop: the sync job commits only when the rendered
+# output differs, so the commit it makes produces a run that finds no change
+# and stops.
+
+on:
+  schedule:
+    - cron: "17 6 * * *"
+  workflow_dispatch:
+  repository_dispatch:
+    types: [legal-updated]
+  push:
+    branches: [main]
+    paths:
+      - tools/render_legal.py
+      - privacy/index.html
+      - .github/workflows/sync-legal.yml
+  pull_request:
+    paths:
+      - tools/render_legal.py
+      - privacy/index.html
+      - .github/workflows/sync-legal.yml
+
+# Source of the policy text. Kept here rather than inline so the two jobs
+# cannot disagree about where it comes from.
+env:
+  POLICY_URL: https://raw.githubusercontent.com/submersion-app/submersion/main/PRIVACY.md
+
+permissions:
+  contents: read
+
+jobs:
+  # On a pull request, verify rather than write. This is what stops someone
+  # hand-editing the generated region of the page: the edit would be silently
+  # reverted by the next sync, so the PR fails instead and says why.
+  check:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Fetch the policy from the app repository
+        run: curl -fsSL --retry 3 "$POLICY_URL" -o /tmp/PRIVACY.md
+
+      - name: Verify the page matches the policy
+        run: |
+          if ! python3 tools/render_legal.py \
+              --source /tmp/PRIVACY.md \
+              --target privacy/index.html \
+              --check; then
+            echo "::error::privacy/index.html does not match PRIVACY.md in the app repo."
+            echo "::error::Edit PRIVACY.md there, not the generated region of this page."
+            echo "::error::To refresh locally: python3 tools/render_legal.py --source <path to PRIVACY.md> --target privacy/index.html"
+            exit 1
+          fi
+
+  sync:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Fetch the policy from the app repository
+        run: curl -fsSL --retry 3 "$POLICY_URL" -o /tmp/PRIVACY.md
+
+      - name: Render the page
+        run: |
+          python3 tools/render_legal.py \
+            --source /tmp/PRIVACY.md \
+            --target privacy/index.html
+
+      - name: Commit if the page changed
+        run: |
+          if git diff --quiet -- privacy/index.html; then
+            echo "Policy page already current; nothing to commit."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add privacy/index.html
+          git commit -m "Sync the privacy policy page with PRIVACY.md
+
+          Regenerated by .github/workflows/sync-legal.yml from
+          submersion-app/submersion. Edit PRIVACY.md there rather than the
+          generated region of this page."
+          git push