fix(ci): make Pages deployment actually work — injection-safe commit, correct permissions, one publisher

[gHashTag]

Follow-up to #611. That PR fixed the MDX error that aborted the docs build; with the build passing, three further defects surfaced — the site still never reached the web.

1. Shell injection / breakage in the deploy step 🔴

git commit -m 'Deploy: ${{ github.event.head_commit.message }}'

The commit message is pasted verbatim into a single-quoted shell string. A message containing ), a quote or a newline breaks the script:

/home/runner/work/_temp/….sh: line 16: syntax error near unexpected token `)'
##[error]Process completed with exit code 2

That is exactly what happened on the last run. The same hole is a command-injection vector — commit messages are attacker-controllable in fork/PR flows.

Fix: pass it through an env: variable, use a deterministic subject (Deploy <sha>) with the original message quoted in the body, add set -euo pipefail, and exit 0 cleanly when there is nothing to publish.

2. deploy-pages.yml missing OIDC permissions

actions/deploy-pages@v4 authenticates via OIDC and failed every run:

Error: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable
##[error]Ensure GITHUB_TOKEN has permission "id-token: write".

Fix: added pages: write + id-token: write and the github-pages environment.

3. Two workflows racing for one Pages target

Both deploy-docs.yml and deploy-pages.yml triggered on push to main. deploy-docs.yml is the real publisher — it builds apps/website and docs and pushes the combined output — while deploy-pages.yml only ever uploaded docs/build.

Fix: deploy-pages.yml is now workflow_dispatch only. Kept, not deleted, with a comment explaining the decision so it can be revived deliberately.

4. Pages source pointed at the wrong branch (repo setting, outside this diff)

Pages was configured as main / while the workflow publishes to the gh-pages branch — so even a successful deploy served nothing. This is why https://t27.ai/trinity/ returned 404. Repointed to gh-pages /.

Verification

• Both workflow files parse as valid YAML.
• gh-pages already received a build after fix(docs): unblock Pages deploy — MDX autolink breaks the Docusaurus build #611 landed, confirming the docs build itself is fixed.
• After merge, a push to main should produce a green Deploy Website + Docs run and a live site — I will confirm the actual HTTP response rather than assume.

Note

Other red checks in this repo (e.g. zig build author-guard reporting "no build.zig file found") are pre-existing on main and unrelated to Pages.

🤖 Generated with Claude Code