From 051e02fdfb19e399b5efc5bba28ab514535159a1 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 18 Sep 2026 15:56:56 +0000
Subject: [PATCH] feat(pages): publish the canonical www bundle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The repo carried .well-known/ at its root, but the Pages artifact is _site,
built from site/ by casket-ssg. The root directory is therefore never
published, so https://hyperpolymath.github.io/ubicity/.well-known/security.txt
has always returned 404.

Two changes:

* .well-known/ -> www/.well-known/, the canonical location per #53. Pure
  renames, content unchanged.

* An additive overlay step in casket-pages.yml, inserted between the site
  build and the archive step, which copies www/public/ to the served root and
  www/.well-known/ to _site/.well-known/. Everything else under www/ (dns/,
  policies/, profiles/, runbooks/, errors/) stays unpublished, so only those
  two subtrees are copied rather than all of www/.

The step is deliberately additive — the generated site is left intact and the
existing homepage is unaffected. This repo hand-rolls its artifact because
upload-pages-artifact nests an unpinned action that the org SHA-pinning rule
rejects, so the overlay is placed before the tar rather than before an upload.
---
 .github/workflows/casket-pages.yml            | 26 +++++++++++++++++++
 {.well-known => www/.well-known}/ai.txt       |  0
 {.well-known => www/.well-known}/dc.xml       |  0
 {.well-known => www/.well-known}/humans.txt   |  0
 {.well-known => www/.well-known}/security.txt |  0
 5 files changed, 26 insertions(+)
 rename {.well-known => www/.well-known}/ai.txt (100%)
 rename {.well-known => www/.well-known}/dc.xml (100%)
 rename {.well-known => www/.well-known}/humans.txt (100%)
 rename {.well-known => www/.well-known}/security.txt (100%)

diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index c5450e6..94f7d07 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -97,6 +97,32 @@ jobs:
           mkdir -p _site
           cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site
           touch ../_site/.nojekyll
+      - name: Overlay the canonical www bundle
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Publish the canonical bundle alongside whatever the SSG produced.
+          #
+          #   www/public/      -> the servable site root
+          #   www/.well-known/ -> must be reachable at /.well-known/ on this
+          #                       origin (RFC 9116, and RSR check
+          #                       www/.well-known/security.txt)
+          #
+          # Everything else under www/ (dns/, policies/, profiles/, runbooks/,
+          # errors/) is source material and is deliberately NOT published, so
+          # only these two subtrees are copied rather than all of www/.
+          #
+          # Deliberately additive: the generated site is left intact, so this
+          # cannot regress the existing pages.
+          if [ -d www/public ]; then
+            cp -a www/public/. _site/
+          fi
+          if [ -d www/.well-known ]; then
+            mkdir -p _site/.well-known
+            cp -a www/.well-known/. _site/.well-known/
+          fi
+          echo "published tree:"
+          find _site -maxdepth 2 | sort
 
       - name: Setup Pages
         uses: actions/configure-pages@v5.0.0
diff --git a/.well-known/ai.txt b/www/.well-known/ai.txt
similarity index 100%
rename from .well-known/ai.txt
rename to www/.well-known/ai.txt
diff --git a/.well-known/dc.xml b/www/.well-known/dc.xml
similarity index 100%
rename from .well-known/dc.xml
rename to www/.well-known/dc.xml
diff --git a/.well-known/humans.txt b/www/.well-known/humans.txt
similarity index 100%
rename from .well-known/humans.txt
rename to www/.well-known/humans.txt
diff --git a/.well-known/security.txt b/www/.well-known/security.txt
similarity index 100%
rename from .well-known/security.txt
rename to www/.well-known/security.txt