ci(pages): split build from deploy, and build on pull requests

.github/workflows/pages.yml

@@ -3,6 +3,12 @@ name: pages
 on:
   push:
     branches: [main]
+  # Build on every pull request too, so a change to the layout, the content or
+  # the Hugo version has to prove the site still builds before it lands.
+  # Without this the workflow ran only on main, which meant a dependency bump
+  # arrived with no signal at all -- its checks read "no checks", which is not
+  # the same thing as green and must not be merged as if it were.
+  pull_request:
   workflow_dispatch:
 
 permissions:
@@ -15,7 +21,11 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build-and-deploy:
+  # Split out of the former single build-and-deploy job. A pull request must be
+  # able to build the site without publishing it, and a job that does both
+  # cannot be gated: guarding it would have skipped the build as well, leaving
+  # the pull request with no signal at all.
+  build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -28,13 +38,26 @@ jobs:
           hugo-version: "0.130.0"
           extended: true
 
+      - uses: actions/configure-pages@v5
+
       - name: Build with Hugo
         run: hugo --minify --gc
 
-      - uses: actions/configure-pages@v5
-
       - uses: actions/upload-pages-artifact@v3
         with:
           path: public/
 
-      - uses: actions/deploy-pages@v4
+  deploy:
+    # Only main publishes. A pull request stops after build above: it has built
+    # the site and uploaded the artifact, which is the whole point of the gate,
+    # and it has no business replacing what is served.
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4