From 540295e4413d5c3b871dfb67719d3a34107e9360 Mon Sep 17 00:00:00 2001
From: tannevaled <tannevaled@users.noreply.github.com>
Date: Wed, 26 Aug 2026 22:20:03 +0200
Subject: [PATCH] ci(pages): split build from deploy, and build on pull
 requests

This workflow ran only on main and had a single build-and-deploy job, so a
pull request got no signal at all -- and the job could not simply be guarded,
because guarding it would have skipped the build too, leaving the pull
request exactly as blind as before.

So split it: build checks out, sets up Hugo, configures Pages, builds and
uploads the artifact; deploy waits on it and runs only for push or
workflow_dispatch. A pull request now builds the site and stops there, which
is the whole point.

Nothing else changes. The pinned versions are untouched -- checkout@v4,
actions-hugo@v3 with hugo 0.130.0, configure-pages@v5, upload-pages-artifact@v3,
deploy-pages@v4 -- as is `hugo --minify --gc` and the existing concurrency
group. Bundling a version bump into a structural change would make both
harder to judge.

Verified before pushing: hugo 0.130.0, the pinned version, builds this tree
locally, and actionlint reports nothing.
---
 .github/workflows/pages.yml | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index e22e100..ecd99ae 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -3,6 +3,12 @@ name: pages
 on:
   push:
     branches: [main]
+  # Build on every pull request too, so a change to the layout, the content or
+  # the Hugo version has to prove the site still builds before it lands.
+  # Without this the workflow ran only on main, which meant a dependency bump
+  # arrived with no signal at all -- its checks read "no checks", which is not
+  # the same thing as green and must not be merged as if it were.
+  pull_request:
   workflow_dispatch:
 
 permissions:
@@ -15,7 +21,11 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build-and-deploy:
+  # Split out of the former single build-and-deploy job. A pull request must be
+  # able to build the site without publishing it, and a job that does both
+  # cannot be gated: guarding it would have skipped the build as well, leaving
+  # the pull request with no signal at all.
+  build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -28,13 +38,26 @@ jobs:
           hugo-version: "0.130.0"
           extended: true
 
+      - uses: actions/configure-pages@v5
+
       - name: Build with Hugo
         run: hugo --minify --gc
 
-      - uses: actions/configure-pages@v5
-
       - uses: actions/upload-pages-artifact@v3
         with:
           path: public/
 
-      - uses: actions/deploy-pages@v4
+  deploy:
+    # Only main publishes. A pull request stops after build above: it has built
+    # the site and uploaded the artifact, which is the whole point of the gate,
+    # and it has no business replacing what is served.
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4