ci: publish to the pages branch on main pushes

Assisted-by: Delta:zai-glm-5.3

.gitea/workflows/build.yml

@@ -1,6 +1,8 @@
 name: Build site
 
-on: push
+on:
+  - push
+  - workflow_dispatch
 
 jobs:
   build:
@@ -26,3 +28,44 @@ jobs:
         with:
           name: public
           path: public/
+
+  deploy:
+    needs: build
+    # Publish only from main; move the gate to publish from another branch.
+    if: github.ref == 'refs/heads/main'
+    # Write access for the automatic Actions token to push the pages branch.
+    permissions:
+      contents: write
+    # NOTE: must match your act_runner labels (e.g. ubuntu-latest, ubuntu-24.04).
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download site artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: public
+          path: public
+
+      - name: Check artifact layout
+        run: test -f public/index.html
+
+      # Publishing interfaces with prod; it never runs under local act tests
+      # (act sets env.ACT, the Gitea runner does not). The force-push to the
+      # `pages` branch is what triggers the git-pages webhook.
+      - name: Publish to pages branch
+        if: ${{ !env.ACT }}
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          if [ -z "$GITEA_TOKEN" ]; then
+            echo "::error::Missing GITEA_TOKEN (the automatic Actions token)."
+            exit 1
+          fi
+          cd public
+          git init -q -b pages .
+          git config user.name "Yggdrasil CI"
+          git config user.email "ci@noreply.kb28.ch"
+          git add -A
+          git commit -q -m "Publish site from ${GITHUB_SHA}"
+          repo_host="${GITHUB_SERVER_URL#*://}"
+          repo_host="${repo_host%/}"
+          git push -q --force "https://${GITHUB_REPOSITORY_OWNER}:${GITEA_TOKEN}@${repo_host}/${GITHUB_REPOSITORY}.git" pages

README.md

@@ -77,5 +77,12 @@ sidebar.
 printable PDF twins, plus `sitemap.xml`, `robots.txt`, and `llms.txt`. The
 Gitea Actions workflow in
 `.gitea/workflows/build.yml` builds the site on every push with the same
-pinned toolchain and uploads `public/` as an artifact for deployment to any
-static host.
+pinned toolchain and uploads `public/` as an artifact.
+
+Pushes to `main` are also published: the `deploy` job force-pushes `public/`
+to the repo's `pages` branch using the automatic Actions token (no secrets to
+configure). A Gitea webhook on the repo then notifies the self-hosted
+[git-pages](https://codeberg.org/git-pages/git-pages) server, which clones
+the `pages` branch and serves the site. The push step is gated with
+`if: ${{ !env.ACT }}` so local `act` runs never publish, and
+`workflow_dispatch` enables manual publishes from the Gitea UI.