diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 87c1e3f..0f3a372 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -97,12 +97,39 @@ jobs:
cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site
touch ../_site/.nojekyll
+ - name: Overlay the canonical www bundle
+ shell: bash
+ run: |
+ set -euo pipefail
+ # Publish the canonical bundle alongside whatever the SSG produced.
+ #
+ # www/public/ -> the servable site root, used as a fallback
+ # www/.well-known/ -> must be reachable at /.well-known/ on this
+ # origin (RFC 9116, and the RSR check on
+ # www/.well-known/security.txt)
+ #
+ # Everything else under www/ (dns/, policies/, profiles/, runbooks/,
+ # errors/) is source material and is deliberately NOT published, so
+ # only these two subtrees are copied rather than all of www/.
+ mkdir -p _site
+ # -n (no-clobber): a page the SSG did produce always wins, so the
+ # bundle can never regress a working site. It only fills the gaps.
+ if [ -d www/public ]; then
+ cp -an www/public/. _site/
+ fi
+ if [ -d www/.well-known ]; then
+ mkdir -p _site/.well-known
+ cp -a www/.well-known/. _site/.well-known/
+ fi
+ echo "published tree:"
+ find _site -maxdepth 2 | sort
- name: Setup Pages
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
- name: Upload artifact
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
with:
+ include-hidden-files: true
path: '_site'
deploy:
diff --git a/www/public/index.html b/www/public/index.html
new file mode 100644
index 0000000..dd21d04
--- /dev/null
+++ b/www/public/index.html
@@ -0,0 +1,21 @@
+
+
+
+
+
+ InvestigativeJournalism.jl
+
+
+
+ InvestigativeJournalism.jl
+ Site in preparation.
+
+ Machine-readable metadata is served from
+ /.well-known/security.txt.
+
+
+