[huang195]

Problem

curl -fsSL https://www.rossoctl.dev/cortex/install.sh | sh runs the website's copy of scripts/install.sh. The site (rossoctl/.github, deploy.yaml) copies the file from this repository only:

• on a push to the site repository;
• on a docs-updated repository dispatch, which this repository never sends;
• on its daily 06:17 UTC schedule, which GitHub can start hours late (on 2026-11-10 it started at 14:54 UTC).

So a new installer option fails as "unknown option" for up to a day after it merges. On 2026-11-10, install.sh --praxis merged at 15:37 UTC, 39 minutes after the site's copy (14:58 UTC). --ref=main did not help, because the script reads every option before it acts on --ref.

Change

• New .github/workflows/site-dispatch.yaml. On a push to main that changes scripts/install.sh (or by hand), it sends docs-updated to rossoctl/.github. The site's deploy workflow already listens for that event. It is a copy of rossoctl/rossoctl's docs-dispatch.yaml, with only the path, the wording and the setup command changed.
• .github/CLAUDE.md: one row in the workflow table.

Setup needed (once, by an admin)

GITHUB_TOKEN cannot dispatch to another repository. Create a fine-grained token with Contents: read and write on rossoctl/.github only, then:

gh secret set SITE_DISPATCH_TOKEN --repo rossoctl/cortex

Until the secret exists, the workflow gives a warning and exits 0. It never fails a merge, and the site's daily schedule still copies the file.

Tests

• yamllint with the config that security-scans.yaml uses: no findings.
• actionlint v1.7.7: no findings.
• pre-commit run on the two files: passed.
• Not run end to end: it needs the secret and a merge to main. After both, run it once by hand (gh workflow run site-dispatch.yaml --repo rossoctl/cortex) and check that a repository_dispatch run starts in rossoctl/.github.

Size: 103 changed lines.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9b7843ee-6414-4128-8b43-3bb7fb9e9599

Commits

Reviewing files that changed from the base of the PR and between 74ec43b and 0f20fb6.

Files selected for processing: 2

• .github/CLAUDE.md
• .github/workflows/site-dispatch.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[clawgenti]

Summary

The fix is sound. I checked the receiving side in rossoctl/.github at main: deploy.yaml listens on repository_dispatch with types: [docs-updated], and scripts/sync-docs.sh always shallow-clones rossoctl/cortex at the default branch and copies scripts/install.sh. A dispatch sent after a push to main therefore rebuilds the site with the merged installer. client_payload is informational only, so the receiver ignores it. The SITE_DISPATCH_TOKEN secret already exists on this repo, and the repository_dispatch deploy run at 03:01 UTC today (run 42949939636, build + deploy) succeeded, so the event path works end to end. The workflow is a close copy of rossoctl/rossoctl's docs-dispatch.yaml. It also improves on it by passing steps.dispatch.outputs.notified through env: instead of interpolating it into run:.

Security: no untrusted event fields reach run:. github.sha, github.actor and the run URL go through env: and are quoted. There is no pull_request/pull_request_target trigger, the job-level permissions is contents: read, and no third-party actions are used, so there is nothing to pin. I left two non-blocking comments: one on scoping the cross-repo token, one on the summary text.

Author: huang195 (MEMBER — maintainer)
Areas reviewed: CI/GitHub Actions, cross-repo receiver contract (rossoctl/.github deploy.yaml + sync-docs.sh), Docs
Agent/IDE config (.claude/.vscode): none
Commits: 1 commit, all signed-off: yes
CI status: passing

[clawgenti]

suggestion: repository_dispatch needs Contents: write on rossoctl/.github, so this secret can also push to the repo that serves /cortex/install.sh, the file people pipe into sh. As written, any job in this repo can read the secret. A write-access user can run workflow_dispatch (or push a workflow file) on any branch, and that branch's copy of this workflow gets the token. You could put the secret in a deployment environment (for example site-dispatch) that allows only main, and add environment: site-dispatch to the job. The token then reaches only workflow files on main. This is not a regression: it is the same pattern as rossoctl/rossoctl's docs-dispatch.yaml. A GitHub App token limited to rossoctl/.github would also make the token short-lived.

[clawgenti]

nit: Because of if: always(), this branch also runs when the token is set but gh api fails (expired token, 403/404, network). notified is then unset, and the summary says "SITE_DISPATCH_TOKEN is not set", which sends the reader to the wrong cause. Wording like "The site was not notified (see the dispatch step)" would cover both cases. The dispatch step's own failure is still visible.