From f65e89cef9e437c1ad4db6efba4d4b66f0977192 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Tue, 28 Jul 2026 09:13:39 -0400
Subject: [PATCH 1/3] ci: validate site builds on pull requests

Adds a Site Build workflow that always runs on pull_request to main so it
can serve as a required status check without deadlocking non-site PRs. A
dorny/paths-filter step detects whether site/**, this workflow, or the
Pages deploy workflow changed; if so the job runs `cd site && npm ci &&
npm run build`. Otherwise it emits a fast success. The existing
pages.yml deploy path is unchanged.

Closes #473

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/site-ci.yml | 65 +++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 .github/workflows/site-ci.yml

diff --git a/.github/workflows/site-ci.yml b/.github/workflows/site-ci.yml
new file mode 100644
index 00000000..66d74b83
--- /dev/null
+++ b/.github/workflows/site-ci.yml
@@ -0,0 +1,65 @@
+name: Site Build
+
+# PR-time validation for the Starlight docs site (site/).
+#
+# This workflow always runs on pull requests targeting main so it can be
+# used as a required status check without deadlocking non-site PRs. A
+# path-filter step detects whether site files actually changed; if not,
+# the expensive build is skipped and the job reports success. The Pages
+# deploy workflow (.github/workflows/pages.yml) still handles the actual
+# deploy on push to main.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'site/**'
+      - '.github/workflows/site-ci.yml'
+      - '.github/workflows/pages.yml'
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: site-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build site
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Detect site changes
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            site:
+              - 'site/**'
+              - '.github/workflows/site-ci.yml'
+              - '.github/workflows/pages.yml'
+
+      - name: Setup Node
+        if: steps.filter.outputs.site == 'true' || github.event_name == 'push'
+        uses: actions/setup-node@v7
+        with:
+          node-version: '22.12.0'
+          cache: npm
+          cache-dependency-path: site/package-lock.json
+
+      - name: Install dependencies
+        if: steps.filter.outputs.site == 'true' || github.event_name == 'push'
+        run: cd site && npm ci
+
+      - name: Build site
+        if: steps.filter.outputs.site == 'true' || github.event_name == 'push'
+        run: cd site && npm run build
+
+      - name: Skip (no site changes)
+        if: steps.filter.outputs.site != 'true' && github.event_name == 'pull_request'
+        run: echo "No site/** changes detected — skipping site build."

From 08c0fdcc5b81335ab1f43d9be5d359ae26661c9a Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Thu, 6 Aug 2026 18:20:13 -0400
Subject: [PATCH 2/3] ci: grant site path filter PR access

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 45a9e53c-b975-4847-b92a-0fcd2bd62b88
---
 .github/workflows/site-ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/site-ci.yml b/.github/workflows/site-ci.yml
index 66d74b83..76e8a5eb 100644
--- a/.github/workflows/site-ci.yml
+++ b/.github/workflows/site-ci.yml
@@ -21,6 +21,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
 concurrency:
   group: site-ci-${{ github.ref }}

From 1b811db0b13f6e0681529907787d9640c0d7c5bf Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Thu, 6 Aug 2026 18:22:05 -0400
Subject: [PATCH 3/3] ci: pin site workflow actions

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 45a9e53c-b975-4847-b92a-0fcd2bd62b88
---
 .github/workflows/site-ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/site-ci.yml b/.github/workflows/site-ci.yml
index 76e8a5eb..28757711 100644
--- a/.github/workflows/site-ci.yml
+++ b/.github/workflows/site-ci.yml
@@ -33,11 +33,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Detect site changes
         id: filter
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3
         with:
           filters: |
             site:
@@ -47,7 +47,7 @@ jobs:
 
       - name: Setup Node
         if: steps.filter.outputs.site == 'true' || github.event_name == 'push'
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22.12.0'
           cache: npm