fix(ci): render the star history chart from the repo's own token

[blafourcade]

🎯 What & why

The star chart in the README was dead: GitHub restricted the stargazers API to a repository's own admins and collaborators on June 30 2026, so api.star-history.com answers with a placeholder image reading "GitHub restricted access to star data". The chart is now rendered by this repository, from its own token.

🛠️ How it works

scripts/generate-star-history.mjs paginates the stargazers API with the star+json media type, builds the cumulative curve and writes an SVG to stdout. No dependency, no network beyond GitHub.

.github/workflows/star-history.yml runs it weekly with github.token and publishes the result on the star-history orphan branch, which README.md:329 embeds over raw.githubusercontent.com.

Three constraints shaped it:

• Orphan branch, not main. The main ruleset requires a pull request, so a scheduled job cannot push a regenerated asset there. A data-only branch also keeps generated bytes out of the source history, and triggers nothing (validate.yml listens on [main, next]).
• Deterministic output. Nothing renders the current date and the x-axis ends at the last star event, so identical star data yields identical bytes. The publish step compares trees and exits without committing when nothing changed.
• No <style>, no <script>, no external font. GitHub strips all three from an SVG served into a README. Colours are neutral enough to read on both themes.

The alternative was star-history's sealed_token: it publishes a real GitHub PAT, encrypted with a key that a third party holds, in the README. Rejected.

Publishing uses git commit-tree / git push plumbing rather than a checkout dance, so the orphan branch never touches the working tree.

🧪 How to verify

• Local render: GH_TOKEN=$(gh auth token) node scripts/generate-star-history.mjs > /tmp/star.svg — the last point matches the number of stargazers fetched (417).
• Published chart: curl -sI https://raw.githubusercontent.com/ai-driven-dev/framework/star-history/star-history.svg → 200, content-type: image/svg+xml. Its bytes are identical to the local render (sha256 42ef322dfcf7…).
• Both workflow paths already ran on this branch through a temporary push trigger, since schedule and workflow_dispatch only fire from the default branch:
  • run 31746866236 — created the branch, * [new branch] … -> star-history.
  • run 31746963019 — Star history unchanged., no commit.
• The temporary trigger is removed in d9c3612.
• Rendered on the branch's README page: the <img> reports complete: true, naturalWidth: 800, naturalHeight: 400, in both the light and dark GitHub themes.

⚠️ Heads-up

• The weekly schedule only starts once this reaches main: GitHub runs schedule and shows the Run workflow button on the default branch only. Until then the chart stays at the 417-star snapshot already published.
• The rendered README embeds the raw.githubusercontent.com URL directly, with no camo proxy in front of it (checked in the branch's rendered HTML), so a refreshed chart only waits on raw's own CDN cache.
• If GitHub ever reopens the stargazers API, both files can be deleted and the one-line third-party embed restored.