chore: prepare verified GitHub Pages deployment

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

.github/workflows/ci.yml

@@ -62,3 +62,28 @@ jobs:
           path: test-results/
           if-no-files-found: ignore
           retention-days: 7
+      - name: Upload GitHub Pages artifact
+        if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' && vars.PAGES_DEPLOYMENT_ENABLED == 'true'
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: dist/
+
+  deploy:
+    name: Deploy to GitHub Pages
+    needs: check
+    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' && vars.PAGES_DEPLOYMENT_ENABLED == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    concurrency:
+      group: github-pages
+      cancel-in-progress: false
+    steps:
+      - name: Deploy verified site
+        id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

AGENTS.md

@@ -1,7 +1,7 @@
 # Registry Stack Marketplace
 
 Separate Astro static marketplace for marketplace.registrystack.org.
-PR preview deployment is authorized. Production deployment stays disabled until Jeremi explicitly authorizes it.
+Regular GitHub Pages deployment is authorized. Resolve the repository visibility or plan prerequisite before enabling PAGES_DEPLOYMENT_ENABLED. Never change repository visibility without Jeremi’s explicit approval.
 
 - npm run check:ci validates a clean checkout without private assets.
 - npm run check adds explicit local private-archive verification.

README.md

@@ -1,6 +1,6 @@
 # Registry Stack Marketplace
 
-Astro static site for marketplace.registrystack.org, kept local and unpublished for review. The source lives in the private registrystack/marketplace repository. Production hosting, domain changes, and production deployment remain disabled.
+Astro static site for marketplace.registrystack.org, kept local and unpublished for review. The source lives in the private registrystack/marketplace repository. Regular GitHub Pages deployment is prepared, with activation pending the repository visibility or plan prerequisite.
 
 ## Review locally
 
@@ -75,7 +75,7 @@ For compatibility with the existing native request form, requests use request_ty
 
 ## Repository and CI
 
-The repository is private at https://github.com/registrystack/marketplace. Marketplace CI runs on pull requests, pushes to main, and manual dispatch. Its token is read-only; it has no production deployment job, Pages write permission, production domain binding, or production secret configuration. Official actions are pinned to immutable commits.
+The repository is private at https://github.com/registrystack/marketplace. Marketplace CI runs on pull requests, pushes to main, and manual dispatch. Its build token is read-only. A separate Pages deployment job has the Pages and OIDC permissions required for publication; it runs only after successful checks on main and when PAGES_DEPLOYMENT_ENABLED is exactly true. Official actions are pinned to immutable commits.
 
 The workflow installs locked dependencies, runs check:ci, executes browser journeys on a temporary loopback server, and checks the fully intercepted request/analytics funnel. It uploads only the verified dist/ site and browser review images, retained for seven days. Preview output rejects ZIPs and other archives, private asset paths, live request/analytics configuration, and indexable HTML.
 
@@ -85,4 +85,4 @@ The tracking protocol and shared client are pinned by data/tracking-contract.jso
 
 Those pins describe the prepared protocol-v3 integration. They do not claim that the main website and documentation have been deployed with it.
 
-PR preview hosting is configured separately from these CI artifacts. A built artifact is not a deployed preview URL. Production remains disabled while the preview hosting account is selected and connected.
+The selected host is regular GitHub Pages. Pull requests produce CI review artifacts; main can publish the checked Pages artifact after explicit activation. GitHub currently refuses Pages activation for this private repository on the organization plan. See docs/github-pages.md for activation steps and the Cloudflare DNS configuration. No separate PR hosting service is required.

docs/cloudflare-dns.json

@@ -0,0 +1,7 @@
+{
+  "type": "CNAME",
+  "name": "marketplace.registrystack.org",
+  "content": "registrystack.github.io",
+  "ttl": 1,
+  "proxied": false
+}

docs/github-pages.md

@@ -0,0 +1,46 @@
+# GitHub Pages and Cloudflare DNS
+
+The marketplace uses the regular GitHub Pages deployment from the checked main branch. CI still runs on every pull request. It publishes only after checks pass, from main, and when the repository variable PAGES_DEPLOYMENT_ENABLED is exactly true. Pull requests never deploy to the production Pages environment.
+
+## Current activation prerequisite
+
+The repository was created private. GitHub rejected Pages activation because the current organization plan does not support Pages for this private repository. The repository must either become public with the owner's explicit approval, or the organization must use a GitHub plan that supports private-repository Pages. Changing source visibility and changing website visibility are different actions; a public website does not require its source to be public on a suitable plan.
+
+No private archive bytes are tracked or uploaded. The 87 request-only ZIPs remain in ignored content/downloads/. Only static catalogue pages, CSS, and browser scripts enter the checked deployment artifact.
+
+## DNS configuration
+
+In the registrystack.org Cloudflare zone:
+
+| Setting | Value |
+| --- | --- |
+| Type | CNAME |
+| Name | marketplace |
+| Target | registrystack.github.io |
+| Proxy status | DNS only, grey cloud |
+| TTL | Auto |
+
+The equivalent Cloudflare API request body is in [cloudflare-dns.json](cloudflare-dns.json). TTL 1 represents Auto. The CNAME target is the organization hostname, without a repository path.
+
+Because this record is DNS only, GitHub serves the TLS certificate. Cloudflare's proxy SSL mode does not control this hostname.
+
+## GitHub activation
+
+After resolving the repository plan or visibility prerequisite:
+
+1. In repository Settings, Pages, select GitHub Actions as the deployment source.
+2. Set the custom domain to marketplace.registrystack.org. A CNAME file in this repository is not required by the Actions publishing method.
+3. Confirm DNS points to registrystack.github.io and enable Enforce HTTPS when GitHub has issued the certificate. Certificate provisioning can take up to 24 hours.
+4. Set the repository variable PAGES_DEPLOYMENT_ENABLED to true.
+5. Run Marketplace CI on main, or push a main-branch change. The deploy job consumes the same artifact that passed the checks.
+
+Setting the activation variable to any other value disables publication. GitHub Pages must be enabled first; the flag does not bypass a GitHub plan restriction.
+
+The initial deployment retains noindex metadata and disallow-all robots.txt while the content remains under review. Form submissions and analytics remain unconfigured. Removing those review controls and enabling live integrations require a deliberate subsequent change.
+
+## Sources
+
+- [GitHub Pages availability](https://docs.github.com/en/pages/getting-started-with-github-pages/what-is-github-pages)
+- [GitHub custom domain setup](https://docs.github.com/en/pages/configuring-a-custom-domain-for-your-github-pages-site/managing-a-custom-domain-for-your-github-pages-site)
+- [GitHub Pages HTTPS](https://docs.github.com/en/pages/getting-started-with-github-pages/securing-your-github-pages-site-with-https)
+- [Cloudflare DNS proxy status](https://developers.cloudflare.com/dns/proxy-status/)

tests/ci-workflow.test.mjs

@@ -2,14 +2,30 @@ import assert from 'node:assert/strict';
 import { readFileSync } from 'node:fs';
 import test from 'node:test';
 
-test('CI checks the archive-free site and publishes only a checked review artifact', () => {
+test('CI checks the archive-free site with read-only build permissions', () => {
   const workflow = readFileSync(new URL('../.github/workflows/ci.yml', import.meta.url), 'utf8');
   assert.match(workflow, /pull_request:/);
   assert.match(workflow, /contents: read/);
   assert.match(workflow, /persist-credentials: false/);
   assert.match(workflow, /runs-on: ubuntu-24\.04/);
   for (const check of ['npm ci', 'npm run check:ci', 'node scripts/check-browser.mjs', 'npm run test:funnel', 'node scripts/verify-preview-artifact.mjs']) assert.ok(workflow.includes(check), check);
   assert.match(workflow, /path: dist\//);
-  assert.doesNotMatch(workflow, /pull_request_target|pages: write|id-token: write|deploy-pages|--prod|content\/downloads/);
+  const checkJob = workflow.split('\n  check:')[1].split('\n  deploy:')[0];
+  assert.doesNotMatch(checkJob, /pages: write|id-token: write|deploy-pages/);
+  assert.doesNotMatch(workflow, /pull_request_target|--prod|content\/downloads/);
   for (const action of workflow.matchAll(/uses: (\S+)/g)) assert.match(action[1], /@[0-9a-f]{40}$/);
 });
+
+test('regular Pages deployment requires passing CI, main, and explicit activation', () => {
+  const workflow = readFileSync(new URL('../.github/workflows/ci.yml', import.meta.url), 'utf8');
+  const deploy = workflow.split('\n  deploy:')[1];
+  assert.ok(deploy, 'Pages deployment job must be prepared.');
+  assert.match(deploy, /needs: check/);
+  assert.match(deploy, /github\.ref == 'refs\/heads\/main'/);
+  assert.match(deploy, /github\.event_name != 'pull_request'/);
+  assert.match(deploy, /vars\.PAGES_DEPLOYMENT_ENABLED == 'true'/);
+  assert.match(deploy, /pages: write/);
+  assert.match(deploy, /id-token: write/);
+  assert.match(deploy, /name: github-pages/);
+  assert.match(deploy, /actions\/deploy-pages@[0-9a-f]{40}/);
+});

tests/cloudflare-config.test.mjs

@@ -0,0 +1,14 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+test('Cloudflare configuration points the marketplace subdomain directly to GitHub Pages', () => {
+  const record = JSON.parse(readFileSync(new URL('../docs/cloudflare-dns.json', import.meta.url), 'utf8'));
+  assert.deepEqual(record, {
+    type: 'CNAME',
+    name: 'marketplace.registrystack.org',
+    content: 'registrystack.github.io',
+    ttl: 1,
+    proxied: false,
+  });
+});