@rm-industries/create-forge 0.4.0-beta.1 → 0.4.0-beta.2

package/dist/template/.github/workflows/automation.yml

@@ -57,3 +57,23 @@ jobs:
 
       - name: Validate workflows
         uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2
+
+  automation:
+    name: Automation
+    needs:
+      - security
+      - syntax
+    if: always()
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Confirm automation checks
+        env:
+          SECURITY_RESULT: ${{ needs.security.result }}
+          SYNTAX_RESULT: ${{ needs.syntax.result }}
+        run: |
+          if [[ "$SECURITY_RESULT" != 'success' || "$SYNTAX_RESULT" != 'success' ]]; then
+            echo '::error title=Automation validation failed::Workflow security and syntax checks must both pass.'
+            exit 1
+          fi
+          echo 'Workflow security and syntax checks passed.'

package/dist/template/.github/workflows/project.yml

@@ -149,6 +149,12 @@ jobs:
           if-no-files-found: error
           retention-days: 7
 
+      - name: Upload GitHub Pages artifact
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
+        with:
+          path: dist
+
   browser-tests:
     name: Browser and accessibility tests
     runs-on: ubuntu-latest
@@ -233,3 +239,24 @@ jobs:
     steps:
       - name: Confirm project checks
         run: echo "All project checks passed."
+
+  deploy:
+    name: Deploy GitHub Pages
+    needs:
+      - build
+      - project
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+
+    permissions:
+      pages: write
+      id-token: write
+
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - name: Deploy GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

package/dist/template/README.md

@@ -62,6 +62,10 @@ The generated `.github/workflows/project.yml` runs on pull requests targeting
 unit tests, the validated production build, browser and accessibility tests,
 and Lighthouse budgets so failures identify the affected gate directly. The
 required `Project` result succeeds only after every release-blocking job passes.
+On pushes to `main`, that result unlocks a separate GitHub Pages deployment;
+pull requests never upload or deploy a Pages artifact. Deployment setup,
+project-site URLs, custom domains, and environment protections are documented in
+[`docs/github-pages.md`](docs/github-pages.md).
 
 The workflow installs dependencies with `npm ci`, caches npm downloads using
 the lockfile, cancels superseded runs on the same Git reference, and grants only
@@ -80,6 +84,10 @@ Security tab without failing the workflow solely because it found an issue.
 The job receives `security-events: write` only for that upload; all other access
 remains read-only. Repositories can make selected code-scanning severities
 merge-blocking later through their ruleset without changing the workflow.
+The `Automation` aggregate runs when `.github/**` changes and succeeds only after
+both workflow syntax and security validation pass. Because it is path-filtered,
+do not configure it as a globally required status check; review it whenever an
+automation change causes it to appear.
 
 Dependabot checks npm and GitHub Actions weekly. Minor and patch npm updates are
 grouped by production or development scope, while major updates remain separate
@@ -141,6 +149,12 @@ configuration, shared layout, and reusable SEO head consume this single
 validated source. New pages should use `src/layouts/BaseLayout.astro` to inherit
 the document shell and canonical metadata.
 
+The canonical URL may include a pathname for a GitHub Pages project site, such
+as `https://owner.github.io/repository`. The Astro configuration derives its
+deployment base from that pathname, and shared URL helpers apply it to local
+navigation, metadata, supporting files, and assets. Root-hosted and custom-domain
+sites use an origin-only URL and therefore have no deployment prefix.
+
 The standalone source template uses `https://example.com` as a valid,
 non-production site origin. Projects created by Forge receive the values
 selected through the generator input contract.

package/dist/template/astro.config.ts

@@ -2,12 +2,16 @@ import sitemap from '@astrojs/sitemap';
 import tailwindcss from '@tailwindcss/vite';
 import { defineConfig } from 'astro/config';
 
+import { getDeploymentConfig } from './src/config/deployment';
 import { site } from './src/config/site';
 
+const deployment = getDeploymentConfig(site.url);
+
 export default defineConfig({
+  base: deployment.base,
   integrations: [sitemap()],
   output: 'static',
-  site: site.url,
+  site: deployment.site,
   trailingSlash: 'always',
   vite: {
     plugins: [tailwindcss()],

package/dist/template/docs/github-pages.md

@@ -0,0 +1,56 @@
+# GitHub Pages deployment
+
+The project workflow publishes the validated production build to GitHub Pages
+after every push to `main`. Pull requests build and test the site, but they do
+not upload a Pages artifact or run a deployment.
+
+## Enable deployment
+
+1. Open the repository's **Settings → Pages** page.
+2. Under **Build and deployment**, select **GitHub Actions** as the source.
+3. Open **Settings → Environments → github-pages** after its first appearance.
+4. Restrict deployment branches to `main`. Add required reviewers when the site
+   needs a manual production approval.
+
+The build job has read-only repository access. The separate deployment job is
+the only job granted `pages: write` and `id-token: write`, and it cannot begin
+until the complete `Project` quality gate succeeds.
+
+## Choose the public URL
+
+Set `url` in `src/config/site.ts` to the complete public address. Forge derives
+Astro's deployment base from this value, so canonical metadata, navigation,
+assets, the RSS feed, the web manifest, and CMS branding use the same path.
+
+For a project site, include the repository name:
+
+```ts
+url: 'https://owner.github.io/repository',
+```
+
+For an organization or user site, use the root address:
+
+```ts
+url: 'https://owner.github.io',
+```
+
+Run `npm run build && npm run validate:build` after changing the URL. Once the
+workflow succeeds on `main`, its deployment summary links to the published site.
+
+## Use a custom domain
+
+Set the site URL to the custom origin without a repository pathname:
+
+```ts
+url: 'https://www.example.com',
+```
+
+Add `public/CNAME` containing only the domain name, configure the same domain in
+**Settings → Pages**, and create the DNS records GitHub documents for the chosen
+domain. The template does not include a `CNAME` file because generated projects
+do not share a domain. Enable **Enforce HTTPS** after GitHub verifies the DNS
+configuration.
+
+Do not configure both a repository pathname and a custom domain. A custom domain
+is served from its root, while a project site uses the repository name as its
+base path.