@@ -0,0 +1,59 @@
+name: Publish workflows to n8n Cloud
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "nodes/**/*.json"
+  workflow_dispatch:
+    inputs:
+      file:
+        description: "Workflow file to publish (blank publishes every workflow under nodes/)"
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-n8n
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    env:
+      N8N_API_KEY: ${{ secrets.N8N_API_KEY }}
+      BEFORE_SHA: ${{ github.event.before }}
+      AFTER_SHA: ${{ github.sha }}
+      INPUT_FILE: ${{ inputs.file }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Collect workflow files
+        run: |
+          set -euo pipefail
+          git config core.quotepath off
+          if [ "${{ github.event_name }}" == "push" ] && [ "$BEFORE_SHA" != "0000000000000000000000000000000000000000" ]; then
+            git diff -z --name-only --diff-filter=AM "$BEFORE_SHA" "$AFTER_SHA" -- 'nodes/*.json' > "$RUNNER_TEMP/files.list"
+          elif [ -n "$INPUT_FILE" ]; then
+            printf '%s\0' "$INPUT_FILE" > "$RUNNER_TEMP/files.list"
+          else
+            git ls-files -z -- 'nodes/*.json' > "$RUNNER_TEMP/files.list"
+          fi
+          echo "Workflows to publish: $(tr -cd '\0' < "$RUNNER_TEMP/files.list" | wc -c)"
+
+      - name: Publish
+        run: |
+          set -euo pipefail
+          failed=0
+          while IFS= read -r -d '' file; do
+            echo "::group::$file"
+            if ! bash scripts/update-workflow.sh "$file"; then
+              failed=1
+            fi
+            echo "::endgroup::"
+          done < "$RUNNER_TEMP/files.list"
+          exit "$failed"
@@ -7,6 +7,15 @@
   2. To run a workflow with Google Drive, set up OAuth2 credentials in Google Cloud Console, [here](https://console.cloud.google.com/apis/credentials).
 4. Ask in the [#ispo-working-group](#ispo-working-group) for help with this repository.
 
+## Publishing workflows to n8n Cloud
+
+Merging a change to a workflow JSON under `nodes/` into `main` publishes it to <https://innersourcecommons.app.n8n.cloud/> automatically, through the `Publish workflows to n8n Cloud` GitHub Action.
+The Action publishes only the workflow files that changed in the push.
+Each file is matched to its workflow by the `id` field in the JSON.
+Publishing replaces the workflow's name, nodes, connections, settings, and static data, and leaves its active or inactive state as it is.
+
+The Action reads the API key from the `N8N_API_KEY` repository secret.
+
 ## Credential errors (e.g. “does not exist for type …”)
 
 n8n stores credentials by **ID** on the server. If you see `Credential with ID "…" does not exist for type "googleDriveOAuth2Api"` on a node such as **Get All Folders**:
 
@@ -1,15 +1,20 @@
 #!/bin/bash
 
-# NOTE: This doesn't work with the $20/month starter plan. (no API access)
-# It does, however, work well with a local instance.
-# https://innersourcecommons.app.n8n.cloud/
+# Pushes one workflow JSON file to https://innersourcecommons.app.n8n.cloud/
+# using the API key in $N8N_API_KEY. CI runs this for each workflow merged to main.
+# Exits non-zero unless the API answers 200.
 
 # Check if a file was provided
 if [ -z "$1" ]; then
   echo "Usage: ./update-workflow.sh <path-to-workflow.json>"
   exit 1
 fi
 
+if [ -z "$N8N_API_KEY" ]; then
+  echo "Error: N8N_API_KEY is not set."
+  exit 1
+fi
+
 WORKFLOW_FILE="$1"
 BASE_URL="https://innersourcecommons.app.n8n.cloud/api/v1"
 
@@ -31,20 +36,22 @@ jq '{name, nodes, connections, settings, staticData} | with_entries(select(.valu
 # Update the workflow
 # The API expects the workflow JSON object in the body.
 # We assume the file contains the full workflow object.
-response=$(curl -s -X PUT "$BASE_URL/workflows/$WORKFLOW_ID" \
+RESPONSE_FILE=$(mktemp)
+status=$(curl -s -o "$RESPONSE_FILE" -w "%{http_code}" -X PUT "$BASE_URL/workflows/$WORKFLOW_ID" \
   -H "X-N8N-API-KEY: $N8N_API_KEY" \
   -H "Content-Type: application/json" \
   -d @"$CLEAN_JSON_FILE")
 
 # Clean up
 rm "$CLEAN_JSON_FILE"
 
-# Check if update was successful (look for id in response)
-if echo "$response" | grep -q "\"id\":\"$WORKFLOW_ID\""; then
+if [ "$status" == "200" ]; then
   echo "Successfully updated workflow."
+  rm "$RESPONSE_FILE"
 else
-  echo "Failed to update workflow. Response:"
-  echo "$response"
+  echo "Failed to update workflow (HTTP $status). Response:"
+  cat "$RESPONSE_FILE"
+  rm "$RESPONSE_FILE"
   exit 1
 fi