bigpowers 2.88.14 → 2.88.15

package/.gemini/extensions/bigpowers/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.14",
+  "version": "2.88.15",
   "description": "81 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "gemini-extension"

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.14",
+  "version": "2.88.15",
   "description": "81 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [2.88.15](https://github.com/danielvm-git/bigpowers/compare/v2.88.14...v2.88.15) (2026-10-25)
+
+
+### Bug Fixes
+
+* **ci:** gate the GitHub Pages deploy on every check in test-build-release ([#164](https://github.com/danielvm-git/bigpowers/issues/164)) ([5f3e4de](https://github.com/danielvm-git/bigpowers/commit/5f3e4de59454d5ffe95d932a3da873db7b4e1d80))
+
 ## [2.88.14](https://github.com/danielvm-git/bigpowers/compare/v2.88.13...v2.88.14) (2026-10-25)
 
 

package/CLAUDE.md

@@ -68,7 +68,7 @@ Stack: Markdown / Bash (documentation-based; skills integrate with Claude Code,
 | Lint    | `bash scripts/sync-skills.sh` (validates SKILL.md syntax) |
 | Validate specs YAML | `bash scripts/validate-specs-yaml.sh` |
 | Typecheck | N/A (Markdown / Bash project) |
-| CI platform | GitHub Actions — one pipeline `.github/workflows/test-build-release.yml` (sync, verification-gates, skill-verify, story-verify → release); plus `docs-site.yml`, `publish-wiki.yml` |
+| CI platform | GitHub Actions — one pipeline `.github/workflows/test-build-release.yml` (sync, verification-gates, skill-verify, story-verify → release, and → pages-build → pages-deploy when docs paths change); plus `publish-wiki.yml` |
 | Compliance | `npm run compliance` |
 | Verification Gates | `bash scripts/run-verification-gates.sh` |
 | Traceability | `bash scripts/trace-stories.sh --strict` | grep for story tags (traceability check) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.14",
+  "version": "2.88.15",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/test-ci-pipeline-contract.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# story: BUG-2026-10-25-release-not-gated
+# story: BUG-2026-10-25-release-not-gated BUG-2026-10-25-pages-not-gated
 # test-ci-pipeline-contract.sh — the CI shape the portfolio template requires
 # (danielvm-git/.github, docs/concept/github-actions-best-practices.md):
 #
@@ -10,6 +10,8 @@
 #   3. no ubuntu-latest; every non-local action is pinned to a 40-char SHA
 #   4. every job has timeout-minutes
 #   5. release and Pages never cancel a run in progress
+#   6. the Pages deploy (any job using actions/deploy-pages) lives in the
+#      pipeline, needs: every gate job and runs only for main
 #
 # Agent workflows (agent-locks.yml, generated agentics-maintenance.yml) are
 # exempt from 3–4 per migration plan v2.
@@ -40,6 +42,27 @@ def cancels(block):
     # Literal true cancels; an expression or false does not cancel a push run.
     return isinstance(block, dict) and block.get("cancel-in-progress") is True
 
+def needs_of(job):
+    needs = job.get("needs", [])
+    return {needs} if isinstance(needs, str) else set(needs)
+
+def ancestors(jobs, name):
+    seen, todo = set(), list(needs_of(jobs.get(name, {})))
+    while todo:
+        n = todo.pop()
+        if n not in seen:
+            seen.add(n)
+            todo.extend(needs_of(jobs.get(n, {})))
+    return seen
+
+def deploys_pages(job):
+    return any(str(st.get("uses", "")).startswith("actions/deploy-pages@")
+               for st in job.get("steps") or [])
+
+def main_only(cond):
+    return ("refs/heads/main" in cond and
+            ("github.event_name == 'push'" in cond or "workflow_dispatch" in cond))
+
 pipe_path = os.path.join(d, "test-build-release.yml")
 if not os.path.isfile(pipe_path):
     bad.append("test-build-release.yml missing")
@@ -49,13 +72,30 @@ else:
     missing = GATES - set(jobs)
     if missing:
         bad.append(f"pipeline lacks gate jobs: {sorted(missing)}")
+    # Gate jobs: the four named ones plus any other job that needs nothing —
+    # a new root job is a gate until it says otherwise with a needs: edge.
+    gate_jobs = (GATES | {n for n, j in jobs.items() if not needs_of(j)}) - {"release"}
     rel = jobs.get("release")
     if not rel:
         bad.append("pipeline has no release job")
-    else:
-        needs = rel.get("needs", [])
-        needs = {needs} if isinstance(needs, str) else set(needs)
-        gate_jobs = set(jobs) - {"release"}
+    pages = [n for n, j in jobs.items() if deploys_pages(j)]
+    if not pages:
+        bad.append("pipeline has no Pages deploy job")
+    for name in pages:
+        job, up = jobs[name], ancestors(jobs, name)
+        if not gate_jobs <= up:
+            bad.append(f"{name}: Pages deploy does not need: {sorted(gate_jobs - up)}")
+        conds = [str(jobs[n].get("if", "")) for n in up | {name} if n in jobs]
+        if any("always()" in c or "cancelled()" in c for c in conds):
+            bad.append(f"{name}: Pages deploy runs even when a gate fails (always()/cancelled())")
+        if not any(main_only(c) for c in conds):
+            bad.append(f"{name}: Pages deploy is not limited to main")
+        if cancels(pipe.get("concurrency")) or cancels(job.get("concurrency")):
+            bad.append(f"{name}: Pages deploy can be cancelled in progress")
+        if not isinstance(job.get("concurrency"), dict) or not job["concurrency"].get("group"):
+            bad.append(f"{name}: Pages deploy has no concurrency group")
+    if rel:
+        needs = needs_of(rel)
         if not gate_jobs <= needs:
             bad.append(f"release does not need: {sorted(gate_jobs - needs)}")
         cond = str(rel.get("if", ""))
@@ -68,16 +108,14 @@ for name in RETIRED:
     if os.path.exists(os.path.join(d, name)):
         bad.append(f"retired workflow still present: {name}")
 
-docs = os.path.join(d, "docs-site.yml")
-if os.path.isfile(docs) and cancels(load(docs).get("concurrency")):
-    bad.append("docs-site.yml: Pages deploy can be cancelled in progress")
-
 for path in sorted(glob.glob(os.path.join(d, "*.yml"))):
     name = os.path.basename(path)
     if name in EXEMPT:
         continue
     for job_name, job in (load(path).get("jobs") or {}).items():
         where = f"{name}:{job_name}"
+        if name != "test-build-release.yml" and deploys_pages(job):
+            bad.append(f"{where}: Pages deploy outside the pipeline (no needs: edge to the gates)")
         if "uses" in job:  # reusable-workflow call: no runner of its own
             continue
         if "ubuntu-latest" in str(job.get("runs-on", "")):
@@ -101,6 +139,7 @@ self_test() {
   tmp=$(mktemp -d)
   trap "rm -rf '$tmp'" EXIT
   local pin="actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"
+  local deploy="actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128"
   write_fixture() { # $1 = dir
     mkdir -p "$1"
     cat > "$1/test-build-release.yml" <<YAML
@@ -117,6 +156,18 @@ jobs:
     timeout-minutes: 15
     concurrency: {group: release, cancel-in-progress: false}
     steps: [{run: "true"}]
+  pages-build:
+    needs: [sync, verification-gates, skill-verify, story-verify]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    steps: [{run: "true"}]
+  pages-deploy:
+    needs: pages-build
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    concurrency: {group: pages, cancel-in-progress: false}
+    steps: [{uses: "$deploy"}]
 YAML
   }
   expect() { # $1 = label, $2 = want pass|fail, $3 = dir
@@ -145,6 +196,28 @@ YAML
   write_fixture "$tmp/retired"; : > "$tmp/retired/publish.yml"
   expect "retired workflow present fails" fail "$tmp/retired"
 
+  write_fixture "$tmp/pages-needs"
+  sed -i.bak '/pages-build:/{n;s/needs: \[.*\]/needs: [sync]/;}' "$tmp/pages-needs/test-build-release.yml"
+  expect "Pages deploy missing gate needs fails" fail "$tmp/pages-needs"
+
+  write_fixture "$tmp/pages-always"
+  sed -i.bak '/pages-deploy:/{n;s/needs: pages-build/needs: pages-build\
+    if: always()/;}' "$tmp/pages-always/test-build-release.yml"
+  expect "Pages deploy with always() fails" fail "$tmp/pages-always"
+
+  write_fixture "$tmp/pages-anyref"
+  sed -i.bak '/pages-build:/{n;n;s/if: .*/if: github.event_name == '"'push'"'/;}' "$tmp/pages-anyref/test-build-release.yml"
+  expect "Pages deploy not limited to main fails" fail "$tmp/pages-anyref"
+
+  write_fixture "$tmp/pages-cancel"
+  sed -i.bak 's/group: pages, cancel-in-progress: false/group: pages, cancel-in-progress: true/' "$tmp/pages-cancel/test-build-release.yml"
+  expect "cancellable Pages deploy fails" fail "$tmp/pages-cancel"
+
+  write_fixture "$tmp/pages-split"
+  printf 'on: push\njobs:\n  deploy: {runs-on: ubuntu-22.04, timeout-minutes: 15, steps: [{uses: %s}]}\n' \
+    "$deploy" > "$tmp/pages-split/docs-site.yml"
+  expect "Pages deploy in a separate workflow fails" fail "$tmp/pages-split"
+
   [ "$ok" -eq 1 ] && echo "OK: pipeline contract self-test" || { echo "pipeline contract self-test FAILED"; exit 1; }
 }