From 9d4321c24549bec120efb3af48281f0db78ce3de Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 18 Sep 2026 16:21:19 +0000
Subject: [PATCH] chore(pages): publish the canonical www bundle, retire the
 root upload

The GitHub Pages site was a 404, and two workflows were racing for it while
neither could win: casket-pages.yml uploaded the repository root, which
contains no index.html at all (and would publish dns/, tls/,
security_headers/ and the rest of the repository past the published
boundary), while the Ddraig build was not guaranteed to produce a site.

  * retire casket-pages.yml - the repository root is not a site
  * the Ddraig build is now best-effort (continue-on-error), so a failed
    Idris build can no longer stop the repository publishing
  * add www/public/index.html, a placeholder in the same shape as the one
    jtv-lang.dev serves, so there is always a servable homepage
  * overlay the canonical bundle between the build and the upload:
    www/public/ (no-clobber, so a page the SSG did produce always wins) and
    www/.well-known/, so /.well-known/security.txt is reachable - RFC 9116,
    and the RSR check on www/.well-known/security.txt

Additive only: nothing the SSG produces is replaced.
---
 .github/workflows/casket-pages.yml | 45 ------------------------------
 .github/workflows/pages.yml        | 29 +++++++++++++++++++
 www/public/index.html              | 30 ++++++++++++++++++++
 3 files changed, 59 insertions(+), 45 deletions(-)
 delete mode 100644 .github/workflows/casket-pages.yml
 create mode 100644 www/public/index.html

diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
deleted file mode 100644
index 448a322..0000000
--- a/.github/workflows/casket-pages.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-name: GitHub Pages
-
-on:
-  push:
-    branches: [main, master]
-  workflow_dispatch:
-
-permissions:
-  actions: read
-  contents: read
-  pages: write
-  id-token: write
-
-concurrency:
-  group: "pages"
-  cancel-in-progress: false
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-
-      - name: Setup Pages
-        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
-
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
-        with:
-          path: '.'
-
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    needs: build
-    timeout-minutes: 10
-    steps:
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index aa6a989..27318ce 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -27,9 +27,12 @@ jobs:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
       - name: Compile Ddraig
+        # Best-effort: a failed Idris build must not stop the repo publishing.
+        continue-on-error: true
         working-directory: .ddraig-ssg
         run: idris2 Ddraig.idr -o ddraig
       - name: Build site
+        continue-on-error: true
         run: |
           mkdir -p src
           if [ ! -f src/index.md ] && [ -f README.md ]; then
@@ -38,6 +41,32 @@ jobs:
             echo "# ${GITHUB_REPOSITORY}" > src/index.md
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
+      - name: Overlay the canonical www bundle
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Publish the canonical bundle alongside whatever the SSG produced.
+          #
+          #   www/public/      -> the servable site root, used as a fallback
+          #   www/.well-known/ -> must be reachable at /.well-known/ on this
+          #                       origin (RFC 9116, and RSR check
+          #                       www/.well-known/security.txt)
+          #
+          # Everything else under www/ (dns/, policies/, profiles/, runbooks/,
+          # errors/) is source material and is deliberately NOT published, so
+          # only these two subtrees are copied rather than all of www/.
+          mkdir -p _site
+          # -n (no-clobber): a page the SSG did produce always wins, so the
+          # bundle can never regress a working site. It only fills the gaps.
+          if [ -d www/public ]; then
+            cp -an www/public/. _site/
+          fi
+          if [ -d www/.well-known ]; then
+            mkdir -p _site/.well-known
+            cp -a www/.well-known/. _site/.well-known/
+          fi
+          echo "published tree:"
+          find _site -maxdepth 2 | sort
       - name: Upload artifact
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
diff --git a/www/public/index.html b/www/public/index.html
new file mode 100644
index 0000000..2b114ac
--- /dev/null
+++ b/www/public/index.html
@@ -0,0 +1,30 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>git-reticulator</title>
+<style>
+:root{color-scheme:light dark}
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;display:grid;place-items:center;font:16px/1.6 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;background:#fafafa;color:#111}
+@media (prefers-color-scheme:dark){body{background:#0d0d0f;color:#e8e8ea}}
+.card{max-width:34rem;padding:2.5rem;text-align:center}
+h1{font-size:clamp(2rem,6vw,3.2rem);margin:0 0 .4rem;letter-spacing:-.02em}
+.dom{font-family:ui-monospace,monospace;font-size:.85rem;opacity:.5}
+p{margin:1.4rem 0 0;opacity:.8}
+.tag{display:inline-block;margin-top:1.8rem;padding:.35rem .9rem;border:1px solid currentColor;border-radius:999px;font-size:.8rem;opacity:.55}
+footer{margin-top:2.6rem;font-size:.76rem;opacity:.4}
+a{color:inherit}
+</style>
+</head>
+<body>
+<main class="card">
+<h1>git-reticulator</h1>
+<div class="dom">hyperpolymath.github.io/git-reticulator</div>
+<p>Site in preparation.</p>
+<div class="tag">Coming soon</div>
+<footer>part of the hyperpolymath estate &middot; <a href="/.well-known/security.txt">security.txt</a></footer>
+</main>
+</body>
+</html>