deploy.yaml

name: Deploy to GitHub Pages

on:
  push:
    branches:
      - master
  # Daily rebuild + manual trigger — refreshes build-time data like the GitHub
  # star count in site/src/data/github.ts without a manual deploy.
  schedule:
    - cron: '0 6 * * *'
  # Allow manual runs from the Actions tab.
  workflow_dispatch:

# Least privilege for the official GitHub Pages deployment: the token only needs
# to publish Pages — no write access to repository source.
permissions:
  contents: read
  pages: write
  id-token: write

# One deployment at a time; never cancel an in-progress one.
concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: site/package-lock.json

      # --ignore-scripts blocks install/postinstall (and binding.gyp/node-gyp)
      # supply-chain vectors — see npm worm advisories (Shai-Hulud). The build
      # works without lifecycle scripts (sharp ships prebuilt binaries).
      - name: Install dependencies
        run: npm ci --ignore-scripts
        working-directory: site
      - name: Build site
        run: npm run build
        working-directory: site
        env:
          # Lifts the GitHub API rate limit for build-time stats fetches.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: site/dist

  deploy:
    name: Deploy
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4