chore(ci): replace Ruby Pages build with Bun/Node publisher

.github/dependabot.yml

@@ -12,6 +12,10 @@ updates:
     # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
     open-pull-requests-limit: 0
   - package-ecosystem: "github-actions"
+    # Ruby is banned for this estate: bump the action, or delete it? Delete.
+    ignore:
+      - dependency-name: "ruby/setup-ruby"
+      - dependency-name: "actions/jekyll-build-pages"
     directory: "/"
     schedule:
       interval: "weekly"

.github/workflows/pages.yml

@@ -1,55 +1,62 @@
 # SPDX-License-Identifier: MPL-2.0
-name: GitHub Pages (Ddraig SSG)
+#
+# Generated by scripts/estate-ruby-exit.mjs — Ruby-free Pages deploy.
+# Replaces the Jekyll workflow (ruby/setup-ruby or actions/jekyll-build-pages):
+# Ruby is banned for this estate, see hyperpolymath/verisimdb-data ADR-0002.
+name: Deploy Pages site
+
 on:
   push:
-    branches: [main, master]
+    branches: ["main", "master"]
   workflow_dispatch:
+
 permissions:
-  actions: read
   contents: read
   pages: write
   id-token: write
+
 concurrency:
   group: "pages"
   cancel-in-progress: false
+
 jobs:
   build:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
-    container:
-      image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
-      - name: Checkout Site
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Checkout Ddraig SSG
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: hyperpolymath/ddraig-ssg
-          path: .ddraig-ssg
-      - name: Compile Ddraig
-        working-directory: .ddraig-ssg
-        run: idris2 Ddraig.idr -o ddraig
-      - name: Build site
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+      - name: Setup Pages
+        id: pages
+        uses: actions/configure-pages@v6.0.0
+      - name: Build site and prove reproducibility
+        env:
+          BASE_PATH: ${{ steps.pages.outputs.base_path }}
         run: |
-          mkdir -p src
-          if [ ! -f src/index.md ] && [ -f README.md ]; then
-            cp README.md src/index.md
-          elif [ ! -f src/index.md ]; then
-            echo "# ${GITHUB_REPOSITORY}" > src/index.md
+          set -euo pipefail
+          if command -v bun >/dev/null 2>&1; then runtime="bun run"; else runtime="node"; fi
+          echo "build runtime: $runtime"
+          $runtime scripts/build-site.mjs --config site.json --baseurl "$BASE_PATH" | tee /tmp/build-1.log
+          rm -rf _site
+          $runtime scripts/build-site.mjs --config site.json --baseurl "$BASE_PATH" | tee /tmp/build-2.log
+          first=$(sed -n 's/.*\(sha256=[0-9a-f]\{64\}\).*/\1/p' /tmp/build-1.log | head -1)
+          second=$(sed -n 's/.*\(sha256=[0-9a-f]\{64\}\).*/\1/p' /tmp/build-2.log | head -1)
+          if [ -z "$first" ] || [ "$first" != "$second" ]; then
+            echo "::error::site build is not reproducible ($first vs $second)"
+            exit 1
           fi
-          ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
-          path: '_site'
+          path: _site
+          include-hidden-files: true
+
   deploy:
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
-    timeout-minutes: 15
     needs: build
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
+        uses: actions/deploy-pages@v5.0.1

.gitignore

@@ -93,3 +93,6 @@ bun.lockb
 yarn.lock
 pnpm-lock.yaml
 .npmrc
+
+# Pages output
+/_site/