Add hourly auto-publish; deploy via API token when available

autodeploy.sh skips the deploy when no listed repo's HEAD moved; it is
driven by a gitsite.timer systemd user unit (hourly). deploy.sh exports
CLOUDFLARE_API_TOKEN from ~/.config/gitsite-cf-token because wrangler
refuses OAuth sessions in non-interactive environments.

Co-Authored-By: Claude Fable 5 <[email protected]>

 autodeploy.sh | 22 ++++++++++++++++++++++
 deploy.sh     |  9 +++++++++
 2 files changed, 31 insertions(+)

diff --git a/autodeploy.sh b/autodeploy.sh
new file mode 100755
index 0000000..abb6829
--- /dev/null
+++ b/autodeploy.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+# Publish git.lucas.co only if any listed repo has new commits.
+# Run by the gitsite.timer systemd user unit; log: ~/.cache/gitsite/autodeploy.log
+set -e
+
+BASE=$(dirname "$(readlink -f "$0")")
+STATE="$HOME/.cache/gitsite/last-publish-heads"
+
+current=$(grep -v '^#' "$BASE/repos.conf" | grep -v '^$' | \
+    while IFS='|' read -r name path desc mode; do
+        echo "$name $(git -C "$path" rev-parse HEAD 2>/dev/null || echo empty)"
+    done | sha256sum | cut -d' ' -f1)
+
+if [ -f "$STATE" ] && [ "$(cat "$STATE")" = "$current" ]; then
+    echo "$(date -Is) no changes, skipping"
+    exit 0
+fi
+
+"$BASE/build.sh"
+"$BASE/deploy.sh"
+printf '%s' "$current" > "$STATE"
+echo "$(date -Is) published"
diff --git a/deploy.sh b/deploy.sh
index f747969..e014e2f 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -6,6 +6,15 @@ set -e
 OUT="$HOME/.cache/gitsite/out"
 [ -d "$OUT" ] || { echo "no build output; run ./build.sh first" >&2; exit 1; }
 
+# Token auth when available: wrangler refuses OAuth in non-interactive
+# environments (e.g. the gitsite.timer systemd unit).
+TOKEN_FILE="$HOME/.config/gitsite-cf-token"
+if [ -f "$TOKEN_FILE" ]; then
+    CLOUDFLARE_API_TOKEN=$(tr -d '[:space:]' < "$TOKEN_FILE")
+    export CLOUDFLARE_API_TOKEN
+    export CLOUDFLARE_ACCOUNT_ID=16cc27b259a59a98845182903fee02e4
+fi
+
 # Pinned: wrangler 4.121.0 ships a dependency on a nonexistent miniflare
 # alpha (npm ETARGET); bump when upstream fixes their release.
 npx -y [email protected] pages deploy "$OUT" --project-name=git-lucas-co --branch=main --commit-dirty=true