From dfb58c64bb8351105ef13428f8f2c415a4977de9 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 19 Sep 2026 08:30:39 +0000
Subject: [PATCH] =?UTF-8?q?fix(pages):=20publish=20.well-known=20=E2=80=94?=
 =?UTF-8?q?=20the=20upload=20was=20stripping=20it?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The canonical bundle was reaching `_site` and then being deleted on the way out.

`actions/upload-pages-artifact` defaults to `include-hidden-files: false`, and
its archiving step is a `tar` that carries `--exclude=.[^/]*`. That pattern
matches every top-level entry beginning with a dot, so `.well-known/` was
stripped from the artifact after the overlay step had placed it correctly.

Evidence from the last run of `pages.yml` — the job's own output:

```
published tree:
_site
_site/.well-known
_site/.well-known/ai.txt
_site/.well-known/humans.txt
_site/.well-known/security.txt
```

...followed by a successful upload and a successful deploy, and then a 404 at
`/.well-known/security.txt`. The overlay is not at fault; the upload is.

`include-hidden-files: true` publishes dot-entries deliberately. `.git` and
`.github` remain excluded by the action regardless.

Confirmed by contrast: `ubicity`, the only repository in the estate that
hand-rolls its `tar` (for SHA-pinning reasons), is the only one serving
`security.txt`.
---
 .github/workflows/jekyll-gh-pages.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml
index 7de66f56..240037c9 100644
--- a/.github/workflows/jekyll-gh-pages.yml
+++ b/.github/workflows/jekyll-gh-pages.yml
@@ -42,6 +42,12 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+          # actions/jekyll-build-pages runs in a container and writes _site as
+          # root, so the runner user cannot create directories inside it.
+          # Without this, the bundle copy below fails with "Permission denied".
+          if [ -d _site ] && [ ! -w _site ]; then
+            sudo chown -R "$(id -u):$(id -g)" _site
+          fi
           # Publish the canonical bundle alongside whatever the SSG produced.
           #
           #   www/public/      -> the servable site root
@@ -69,6 +75,11 @@ jobs:
           find _site -maxdepth 2 | sort
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v5.0.0
+        with:
+          # actions/upload-pages-artifact strips dot-entries by default
+          # (its tar runs --exclude=.[^/]*), which silently removed
+          # .well-known/ from the artifact. Publish it deliberately.
+          include-hidden-files: true
 
   # Deployment job
   deploy: