Use canonical repository for Bridgistic Pages

.github/workflows/pages-release.yml

@@ -1,20 +1,25 @@
-name: Deploy Bridgistic site from release
+name: Deploy Bridgistic site
 
-# The WordPressistic marketplace repository is the public distribution source
-# for bridgistic.app. The scheduled sync keeps the site on the latest public
-# marketplace release without requiring a cross-repository personal token.
-# A repository administrator must switch Pages > Build and deployment > Source
+# The linked Bridgistic repository owns both the landing-page source and the
+# plugin releases. The site advertises the latest release without importing
+# release-tag HTML, while the commit marker ensures page edits deploy too.
+# A repository administrator must set Pages > Build and deployment > Source
 # to "GitHub Actions" once before this workflow can deploy.
 
 on:
-  release:
-    types: [published]
+  push:
+    branches: [main]
+    paths:
+      - index.html
+      - assets/bridgistic-icon.png
+      - assets/bridgistic-logo.png
+      - .github/workflows/pages-release.yml
   schedule:
     - cron: "*/15 * * * *"
   workflow_dispatch:
     inputs:
       tag:
-        description: "Marketplace release tag (blank uses the latest release)"
+        description: "Bridgistic release tag (blank uses the latest release)"
         required: false
         default: ""
         type: string
@@ -30,106 +35,97 @@ concurrency:
 
 jobs:
   deploy:
-    name: Deploy the latest marketplace release
+    name: Deploy the repository landing page
     runs-on: ubuntu-latest
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - name: Resolve the marketplace release
+      - name: Check out the Bridgistic site source
+        uses: actions/checkout@v4
+
+      - name: Resolve the latest Bridgistic release
         id: release
         env:
-          EVENT_TAG: ${{ github.event.release.tag_name || '' }}
           INPUT_TAG: ${{ inputs.tag || '' }}
           GH_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          if [ -n "$EVENT_TAG" ]; then
-            TAG="$EVENT_TAG"
-          elif [ -n "$INPUT_TAG" ]; then
+          if [ -n "$INPUT_TAG" ]; then
             TAG="$INPUT_TAG"
           else
             TAG=$(curl --fail --silent --show-error --location \
               --connect-timeout 10 --max-time 30 \
               -H "Accept: application/vnd.github+json" \
               -H "Authorization: Bearer $GH_TOKEN" \
-              https://api.github.com/repos/Wordpressistic/bridgistic-claude-marketplace/releases/latest \
+              https://api.github.com/repos/Wordpressistic/bridgistic/releases/latest \
               | jq -r '.tag_name')
           fi
           if ! printf '%s' "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$'; then
-            echo "::error::Invalid marketplace release tag: $TAG"
+            echo "::error::Invalid Bridgistic release tag: $TAG"
             exit 1
           fi
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "Using marketplace release $TAG"
+          echo "Using Bridgistic release $TAG"
 
-      - name: Skip when this release is already deployed
+      - name: Skip when this site build is already deployed
         id: deployed
         env:
           TAG: ${{ steps.release.outputs.tag }}
+          SITE_COMMIT: ${{ github.sha }}
         run: |
           VERSION="${TAG#v}"
           CURRENT=$(curl --silent --show-error --location --connect-timeout 10 --max-time 20 https://bridgistic.app/ 2>/dev/null || true)
-          if printf '%s' "$CURRENT" | grep -q "v${VERSION}"; then
+          if printf '%s' "$CURRENT" | grep -Fq "release=${VERSION}" \
+            && printf '%s' "$CURRENT" | grep -Fq "site-commit=${SITE_COMMIT}"; then
             echo "already=true" >> "$GITHUB_OUTPUT"
-            echo "${TAG} is already live on bridgistic.app."
+            echo "${TAG} from ${SITE_COMMIT} is already live on bridgistic.app."
           else
             echo "already=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Check out the exact marketplace release
-        if: steps.deployed.outputs.already != 'true'
-        uses: actions/checkout@v4
-        with:
-          repository: Wordpressistic/bridgistic-claude-marketplace
-          ref: ${{ steps.release.outputs.tag }}
-          path: source
-
-      - name: Resolve and inject release version
+      - name: Inject release and source versions
         if: steps.deployed.outputs.already != 'true'
         env:
           RELEASE_TAG: ${{ steps.release.outputs.tag }}
+          SITE_COMMIT: ${{ github.sha }}
         run: |
           VERSION="${RELEASE_TAG#v}"
           if ! printf '%s' "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$'; then
-            echo "::error::Invalid release tag: $RELEASE_TAG"
+            echo "::error::Invalid Bridgistic release tag: $RELEASE_TAG"
             exit 1
           fi
-          perl -0pi -e "s/__BRIDGISTIC_RELEASE_VERSION__/$VERSION/g" source/index.html
-          # Keep the public site aligned with the organization marketplace
-          # even when deploying an older marketplace tag that still contained
-          # the previous release links.
-          perl -0pi -e 's#https://github.com/Wordpressistic/bridgistic(?=/|")#https://github.com/Wordpressistic/bridgistic-claude-marketplace#g' source/index.html
-          if grep -q '__BRIDGISTIC_RELEASE_VERSION__' source/index.html; then
-            echo "::error::The release version marker was not fully replaced"
+          perl -0pi -e "s/__BRIDGISTIC_RELEASE_VERSION__/$VERSION/g; s/__BRIDGISTIC_SITE_COMMIT__/$SITE_COMMIT/g" index.html
+          if grep -Eq '__BRIDGISTIC_(RELEASE_VERSION|SITE_COMMIT)__' index.html; then
+            echo "::error::A site build marker was not fully replaced"
             exit 1
           fi
 
       - name: Configure GitHub Pages
         if: steps.deployed.outputs.already != 'true'
         uses: actions/configure-pages@v5
 
-      - name: Stage only the public site
+      - name: Stage the public site from this repository
         if: steps.deployed.outputs.already != 'true'
         run: |
           rm -rf dist/pages-site
           mkdir -p dist/pages-site/assets
-          cp source/index.html dist/pages-site/index.html
+          cp index.html dist/pages-site/index.html
           printf 'bridgistic.app\n' > dist/pages-site/CNAME
-          cp source/assets/bridgistic-icon.png dist/pages-site/assets/bridgistic-icon.png
-          cp source/assets/bridgistic-logo.png dist/pages-site/assets/bridgistic-logo.png
+          cp assets/bridgistic-icon.png dist/pages-site/assets/bridgistic-icon.png
+          cp assets/bridgistic-logo.png dist/pages-site/assets/bridgistic-logo.png
 
-      - name: Upload release site
+      - name: Upload the Pages artifact
         if: steps.deployed.outputs.already != 'true'
         uses: actions/upload-pages-artifact@v3
         with:
           path: dist/pages-site
 
-      - name: Deploy release site
+      - name: Deploy Bridgistic on GitHub Pages
         id: deployment
         if: steps.deployed.outputs.already != 'true'
         uses: actions/deploy-pages@v4
 
-      - name: Confirm deployment is current
+      - name: Confirm the deployed build is current
         if: steps.deployed.outputs.already == 'true'
-        run: echo "GitHub Pages already serves ${{ steps.release.outputs.tag }}."
+        run: echo "GitHub Pages already serves ${{ steps.release.outputs.tag }} from ${{ github.sha }}."

docs/PAGES_RELEASES.md

@@ -1,22 +1,33 @@
-# Release-backed Bridgistic site
+# GitHub Pages deployment
 
-The public site at https://bridgistic.app/ should represent a published
-release, not an arbitrary commit on main.
+The public site at https://bridgistic.app/ is built from this repository's
+`index.html` and `assets/` directory. This keeps the landing page, download
+links, security information, and product documentation aligned with the
+canonical Bridgistic repository.
 
-The pages-release.yml workflow checks out the exact GitHub release tag,
-injects that tag's version into the landing page, stages only the public
-landing page and its branding assets, and deploys the result to the
-github-pages environment. The download links continue to use GitHub's
-stable releases/latest/download/... URLs, so they move to the newest
-published release automatically.
+## Deployment behavior
+
+- Changes to the landing page, its brand assets, or the Pages workflow on
+  `main` trigger a deployment.
+- Each deployment resolves the latest published Bridgistic release and injects
+  its version into the page. A source commit marker also ensures page edits are
+  deployed even when the release version has not changed.
+- The release workflow dispatches a Pages deployment at the immutable release
+  tag, so a newly published release can be verified against its exact source.
+- A scheduled run reconciles the public page with the current `main` source and
+  latest release. Manual dispatch can select a specific release tag.
+- The workflow stages only `index.html`, the two public brand assets, and the
+  `bridgistic.app` CNAME file.
+
+The page's download buttons use GitHub's stable `releases/latest/download/...`
+URLs, so downloads continue to follow the newest published release.
 
 ## One-time repository setting
 
-In the repository settings, open Pages → Build and deployment and change
-Source from branch deployment to **GitHub Actions**. This is a repository
-setting and cannot be safely inferred or changed by a source-code commit.
-After that one-time change, publishing a release triggers the workflow.
+In repository settings, open **Pages → Build and deployment** and set Source to
+**GitHub Actions**. The current repository setting is already configured for
+GitHub Actions; this note is retained for maintainers setting up a new repo.
 
-Use the manual workflow dispatch only to repair or redeploy a known release
-tag. Verify both the workflow environment URL and the public
-https://bridgistic.app/ page after deployment.
+After deployment, verify the workflow environment URL and the public
+https://bridgistic.app/ page. Confirm that the page shows the expected release
+version and source commit.

index.html

@@ -12,6 +12,8 @@
   <title>Bridgistic — Safe AI Control for WordPress via MCP</title>
   <meta name="description" content="Connect Claude, ChatGPT, Codex, Gemini, Cursor and other MCP clients to WordPress with signed requests, scoped access, approvals, snapshots, rollback and audit logs." />
   <link rel="canonical" href="https://bridgistic.app/" />
+  <!-- Build metadata is injected from this repository and the latest plugin release. -->
+  <!-- site-commit=__BRIDGISTIC_SITE_COMMIT__; release=__BRIDGISTIC_RELEASE_VERSION__ -->
 
   <meta property="og:type" content="website" />
   <meta property="og:site_name" content="Bridgistic" />