From 8abfa3d31b9e55c38f95601d29cd8ecd5b993051 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 19 Sep 2026 08:30:23 +0000
Subject: [PATCH] =?UTF-8?q?fix(pages):=20publish=20.well-known=20=E2=80=94?=
 =?UTF-8?q?=20the=20upload=20was=20stripping=20it?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The canonical bundle was reaching `_site` and then being deleted on the way out.

`actions/upload-pages-artifact` defaults to `include-hidden-files: false`, and
its archiving step is a `tar` that carries `--exclude=.[^/]*`. That pattern
matches every top-level entry beginning with a dot, so `.well-known/` was
stripped from the artifact after the overlay step had placed it correctly.

Evidence from the last run of `pages.yml` — the job's own output:

```
published tree:
_site
_site/.well-known
_site/.well-known/ai.txt
_site/.well-known/humans.txt
_site/.well-known/security.txt
```

...followed by a successful upload and a successful deploy, and then a 404 at
`/.well-known/security.txt`. The overlay is not at fault; the upload is.

`include-hidden-files: true` publishes dot-entries deliberately. `.git` and
`.github` remain excluded by the action regardless.

Confirmed by contrast: `ubicity`, the only repository in the estate that
hand-rolls its `tar` (for SHA-pinning reasons), is the only one serving
`security.txt`.
---
 .github/workflows/pages.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 27318ce..9503727 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -71,6 +71,10 @@ jobs:
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: '_site'
+          # actions/upload-pages-artifact strips dot-entries by default
+          # (its tar runs --exclude=.[^/]*), which silently removed
+          # .well-known/ from the artifact. Publish it deliberately.
+          include-hidden-files: true
   deploy:
     environment:
       name: github-pages