From e0c40e63814b93a4aa24da733435790829cb7c8d Mon Sep 17 00:00:00 2001
From: tannevaled <tannevaled@users.noreply.github.com>
Date: Sun, 30 Aug 2026 17:51:01 +0200
Subject: [PATCH] Build the site on pull requests, publish only from main

The Pages workflow triggered on `push` to main and `workflow_dispatch` only,
so nothing ran on a pull request: a dependency bump or a content change was
mergeable with `total_count: 0` check runs on its head sha, and the first
evidence of a mistake would have been a broken published site. "No checks" is
not the same thing as green.

Add a `pull_request` trigger so the build proves the site still builds, and
gate the deploy job on the event so a pull request never publishes.

Permissions and concurrency follow from that: `pages: write` and
`id-token: write` move down to the deploy job, the only job that needs them,
and the concurrency group is scoped by ref so a pull request neither waits
behind a deploy nor holds one up.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/pages.yml | 38 ++++++++++++++++++++++++++++++++-----
 1 file changed, 33 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 65eba2c..2fead5e 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -3,19 +3,31 @@ name: pages
 on:
   push:
     branches: [main]
+  # Build on every pull request too, so a change to the sources, the Go
+  # version or one of the actions below has to prove the site still builds
+  # before it lands. Without this the workflow ran only on main, so a
+  # dependency bump arrived with no signal at all: its checks read "no checks",
+  # which is not the same thing as green and must not be merged as if it were.
+  pull_request:
   workflow_dispatch:
 
+# The build needs nothing beyond the source and the Pages configuration it
+# reads. Publishing rights are granted to the deploy job alone, below, so a
+# pull request build cannot replace what is served even if a step in it
+# misbehaves.
 permissions:
   contents: read
-  pages: write
-  id-token: write
+  pages: read
 
+# Deploys serialise with one another under the main group; each pull request
+# gets a group of its own, so it neither waits behind a deploy nor holds one
+# up, and a new push supersedes the run still in flight for the same ref.
 concurrency:
-  group: pages
+  group: pages-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  build-and-deploy:
+  build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -50,4 +62,20 @@ jobs:
         with:
           path: site/
 
-      - uses: actions/deploy-pages@v5
+  deploy:
+    # Only main publishes. A pull request stops after the build above: it has
+    # proved the site builds, which is the whole point of the gate, and it has
+    # no business replacing the published site.
+    if: github.event_name != 'pull_request'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v5