From 4b4caeac028aaba7e941fa237fe31afd7bb959a5 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 19 Sep 2026 20:57:55 +0000
Subject: [PATCH] chore(pages): publish the canonical www bundle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The repository carries www/.well-known/ but nothing was copying it into
the Pages artifact, so /.well-known/security.txt 404s — RFC 9116
discovery, and the RSR check on www/.well-known/security.txt.
* overlay the bundle between the build and the upload: www/public/
with no-clobber (a page the SSG produced always wins) and
www/.well-known/ unconditionally
* include-hidden-files: true on the upload — without it
actions/upload-pages-artifact strips .well-known/ from the artifact
after the overlay places it, every step reports success, and the
file still 404s
Additive only: nothing the SSG produces is replaced.
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
.github/workflows/casket-pages.yml | 27 +++++++++++++++++++++++++++
www/public/index.html | 21 +++++++++++++++++++++
2 files changed, 48 insertions(+)
create mode 100644 www/public/index.html
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 87c1e3f..0f3a372 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -97,12 +97,39 @@ jobs:
cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site
touch ../_site/.nojekyll
+ - name: Overlay the canonical www bundle
+ shell: bash
+ run: |
+ set -euo pipefail
+ # Publish the canonical bundle alongside whatever the SSG produced.
+ #
+ # www/public/ -> the servable site root, used as a fallback
+ # www/.well-known/ -> must be reachable at /.well-known/ on this
+ # origin (RFC 9116, and the RSR check on
+ # www/.well-known/security.txt)
+ #
+ # Everything else under www/ (dns/, policies/, profiles/, runbooks/,
+ # errors/) is source material and is deliberately NOT published, so
+ # only these two subtrees are copied rather than all of www/.
+ mkdir -p _site
+ # -n (no-clobber): a page the SSG did produce always wins, so the
+ # bundle can never regress a working site. It only fills the gaps.
+ if [ -d www/public ]; then
+ cp -an www/public/. _site/
+ fi
+ if [ -d www/.well-known ]; then
+ mkdir -p _site/.well-known
+ cp -a www/.well-known/. _site/.well-known/
+ fi
+ echo "published tree:"
+ find _site -maxdepth 2 | sort
- name: Setup Pages
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
- name: Upload artifact
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
with:
+ include-hidden-files: true
path: '_site'
deploy:
diff --git a/www/public/index.html b/www/public/index.html
new file mode 100644
index 0000000..dd21d04
--- /dev/null
+++ b/www/public/index.html
@@ -0,0 +1,21 @@
+
+
+
+
+
+ InvestigativeJournalism.jl
+
+
+
+ InvestigativeJournalism.jl
+ Site in preparation.
+
+ Machine-readable metadata is served from
+ /.well-known/security.txt.
+
+
+