Deploy the site from CI

.github/workflows/site.yml

@@ -0,0 +1,57 @@
+name: Site
+
+# Builds format.gocassini.com on every pull request and deploys it to
+# Cloudflare Pages (project cassini-format) on every push to main.
+#
+# No paths filter: the site renders SPEC.md, spec/, design/ and CHANGELOG.md,
+# and the build fails on a dead link or anchor in them (see site/README.md), so
+# a spec-only change needs the build as much as a site change does.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: site-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: site
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # The demo audio is in LFS; without it the site ships pointer files.
+          lfs: true
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: site/package-lock.json
+
+      - run: npm ci
+
+      - name: Build
+        run: npm run build
+        env:
+          SITE_URL: https://format.gocassini.com
+
+      - name: Deploy to Cloudflare Pages
+        if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+        run: >-
+          npx --yes wrangler@4 pages deploy build
+          --project-name cassini-format
+          --branch main
+          --commit-hash ${{ github.sha }}
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

site/README.md

@@ -95,8 +95,13 @@ Cassini’s AGPL-3.0 component; its vendored source and license are included in
 URL, which every static host does by default. `404.html` is the not-found page.
 
 Production uses Cloudflare Pages Direct Upload, project `cassini-format`.
-Build from a clean checkout of merged `main` (including Git LFS demo assets),
-so unrelated local static files cannot enter the deployment:
+Every push to `main` deploys automatically through
+`.github/workflows/site.yml`, which also builds every pull request. It needs
+the repository secrets `CLOUDFLARE_API_TOKEN` (Cloudflare Pages: Edit on the
+Code Myriad account) and `CLOUDFLARE_ACCOUNT_ID`.
+
+To deploy by hand, build from a clean checkout of merged `main` (including Git
+LFS demo assets), so unrelated local static files cannot enter the deployment:
 
 ```bash
 npm ci