From 6f2d9e734e6fc042536cc43323a8c7aab6a295b5 Mon Sep 17 00:00:00 2001
From: nicodes <nicozessoules@gmail.com>
Date: Sat, 1 Aug 2026 19:19:05 -0600
Subject: [PATCH] Standardize CI on the org shape

Build and Test become .github/actions/*, called as steps from a one-job
ci.yml -- the same shape the rest of the organisation uses. The job is
renamed build -> ci.

The toolchain now comes from .mise.toml via mise-action, rather than
oven-sh/setup-bun with the version written out in the workflow. bun was
pinned in two places and only one of them is the one anybody edits.

The no-JavaScript assertion now looks at the tree rather than grepping
index.html for a <script src>. A bundle that is emitted but not yet
referenced is still a runtime that arrived, and the emitting is the
change worth catching. Verified against a local build first: this site
emits zero .js files, so the stricter form passes today.

This site's own assertions -- how many pages it emits, and what else has
to be on them -- are preserved verbatim. That is the part worth keeping
per-repo.

Third-party actions pinned by SHA with the tag in a trailing comment,
and timeout-minutes on the job.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/actions/build/action.yml | 28 +++++++++++++++++
 .github/actions/test/action.yml  | 34 +++++++++++++++++++++
 .github/workflows/ci.yml         | 52 +++++++++++++++++---------------
 3 files changed, 90 insertions(+), 24 deletions(-)
 create mode 100644 .github/actions/build/action.yml
 create mode 100644 .github/actions/test/action.yml

diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml
new file mode 100644
index 0000000..78f653b
--- /dev/null
+++ b/.github/actions/build/action.yml
@@ -0,0 +1,28 @@
+name: Build
+description: >
+  The static site, into ./dist.
+
+  A composite action rather than a reusable workflow so it runs in the caller's
+  job, under the caller's name -- CI / Build -- rather than as a nested
+  "caller / callee" check.
+
+  It has exactly one caller: there is no CD here, so nothing can drift from
+  anything. It is split out so this repository has the same shape as the rest of
+  the organisation, and for no stronger reason than that.
+
+  NOTHING LEAVES THE RUNNER. The site is left in ./dist for ../test to assert
+  against.
+
+runs:
+  using: composite
+  steps:
+    # --frozen-lockfile so CI fails on a lockfile that does not match
+    # package.json, rather than quietly resolving something newer than what
+    # anyone has run locally.
+    - name: Install JS dependencies
+      shell: bash
+      run: bun install --frozen-lockfile
+
+    - name: Build
+      shell: bash
+      run: bun run build
diff --git a/.github/actions/test/action.yml b/.github/actions/test/action.yml
new file mode 100644
index 0000000..ff0feef
--- /dev/null
+++ b/.github/actions/test/action.yml
@@ -0,0 +1,34 @@
+name: Test
+description: >
+  Is this commit good. Nothing is published here; a failure means the site is
+  wrong, not that the pipeline is.
+
+  Runs AFTER ../build, because everything it asserts is a property of ./dist. A
+  static site has two ways to be broken that matter -- it did not build, and it
+  built the wrong thing -- and only the second one needs a test.
+
+  The assertions are this site's own and differ from its siblings': how many
+  pages it emits, and what else has to be on them. That is the part worth
+  keeping per-repo.
+
+runs:
+  using: composite
+  steps:
+    # A build that emits nothing still "succeeds", so the artefact is checked
+    # rather than the exit code.
+    - name: The page was actually written
+      shell: bash
+      run: test -s dist/index.html
+    # The point of this site is that it ships no JavaScript. Nothing else
+    # would notice an integration being added back, and by then the page has
+    # a runtime it did not need. The registry application is a separate app
+    # at app.gdam.dev; this repository is only the front door.
+    - name: No JavaScript was shipped
+      shell: bash
+      run: |
+        if find dist -name '*.js' | grep -q .; then
+          echo "::error::dist contains JavaScript -- this site is meant to ship none"
+          find dist -name '*.js'
+          exit 1
+        fi
+
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fa27159..201d1d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,11 +1,17 @@
 name: CI
 
-# A static site has one way to be broken that matters: it does not build. That
-# is the whole check.
+# Every pull request and every merge to main: build, then test, on one runner.
+#
+# Nothing is published and nothing is deployed, so a green tick means one thing
+# -- this commit is good.
+#
+# The push trigger is not redundant: this repository has no CD, so nothing else
+# covers a merge to main.
+
 on:
+  pull_request:
   push:
     branches: [main]
-  pull_request:
   workflow_dispatch:
 
 permissions:
@@ -16,26 +22,24 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build:
+  ci:
     runs-on: ubuntu-latest
+    # Bounded, so a step that hangs fails here rather than sitting until the
+    # runner's own timeout hours later.
+    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3"
-      - run: bun install --frozen-lockfile
-      - run: bun run build
-      # A build that emits nothing still "succeeds", so the artefact is checked
-      # rather than the exit code.
-      - name: The page was actually written
-        run: test -s dist/index.html
-      # The point of this site is that it ships no JavaScript. Nothing else
-      # would notice an integration being added back, and by then the page has
-      # a runtime it did not need. The registry application is a separate app
-      # at app.gdam.dev; this repository is only the front door.
-      - name: No JavaScript was shipped
-        run: |
-          if grep -q '<script[^>]*src=' dist/index.html; then
-            echo "dist/index.html loads a script — the page is meant to ship none"
-            exit 1
-          fi
+      # Third-party actions are pinned by SHA, with the tag in a trailing
+      # comment so the version is still readable.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      # Reads .mise.toml, which is where bun's version is already pinned for
+      # everyone working on this repo. This used to be oven-sh/setup-bun with
+      # `bun-version: "1.3"` written out here -- a second place to change one
+      # version, and two places drift.
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+
+      - name: Build
+        uses: ./.github/actions/build
+
+      - name: Test
+        uses: ./.github/actions/test