Parent: #1224 (Epic: Recipe health tracking, ADR-009 V1)

Summary

Structurally clone .github/workflows/bom-refresh.yaml so the public matrix stays current via a weekly, drift-only bot PR (ADR-009 §5).

Scope

New workflow mirroring bom-refresh.yaml:

• Weekly cron, offset from bom-refresh — bom-refresh is 0 6 * * 1; use e.g. 30 6 * * 1 so two bot PRs don't land simultaneously every Monday and contend for /ok re-fire and runner capacity. Plus workflow_dispatch.
• Weekly, not daily — V1 health changes only on code/registry/chart merges, not the calendar.
• permissions: contents: read globally; the job overrides contents: write + pull-requests: write.
• Checkout (persist-credentials: false), load-versions, setup Go. No Helm setup — health is render-free (the one deliberate divergence from bom-refresh).
• run: make recipe-health-docs.
• peter-evans/create-pull-request (pin the same SHA as bom-refresh): commit-message/title chore(health): refresh recipe health matrix, branch: chore/health-refresh, delete-branch: true, labels: documentation / area/docs / area/recipes, built-in GITHUB_TOKEN (the /ok reviewer-comment policy re-fires CI on bot PRs).
• Write per-dimension detail to $GITHUB_STEP_SUMMARY for at-a-glance maintainer triage.

Out of scope

PR-time sticky-comment apparatus (deferred); a blocking gate (health is advisory).

Key files

.github/workflows/bom-refresh.yaml (template — note its GITHUB_TOKEN + /ok comment), .github/actions/load-versions.

Tests

Workflow lint; manual workflow_dispatch dry run. CODEOWNERS already routes /.github/** to @nvidia/aicr-maintainer.

Acceptance

A drift-only weekly PR opens against chore/health-refresh, labeled, with step-summary detail, cron-offset from bom-refresh, no Helm/network dependency.

Dependencies

Depends on #1229 (the recipe-health-docs target + committed matrix doc).