Workflows: build once per push, never cancel a live deploy, job timeouts

pages.yml now calls ci.yml with upload-dist, which checks out full history,
runs tests, validate and the page-checking build, and uploads site/dist as
the Pages artifact; the separate build job is gone and ci.yml no longer
runs on push to main, so a push builds the site once instead of three
times. cancel-in-progress is off for the pages group. Every job has a
timeout-minutes (part of #134).

Closes #136

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: TMHSDigital

.github/workflows/ci.yml

@@ -2,21 +2,32 @@ name: Validate catalog
 
 # No path filters: the build reads catalog/, stacks/, docs/, site/ and the
 # top-level Markdown files, and the whole run takes seconds.
+#
+# Runs on pull requests, and as the first job of pages.yml on every push to
+# main (so a push builds once, not three times). With `upload-dist` the
+# checkout has full history (the sitemap's lastmod dates come from git) and
+# the built site is uploaded as the Pages artifact for pages.yml to deploy.
 on:
   pull_request:
-  push:
-    branches: [main]
   workflow_call:
+    inputs:
+      upload-dist:
+        description: Build with full git history and upload site/dist as the Pages artifact
+        type: boolean
+        default: false
 
 permissions:
   contents: read
 
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: ${{ inputs.upload-dist && '0' || '1' }}
 
       - name: Setup Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -32,3 +43,9 @@ jobs:
         run: node site/validate.mjs
       - name: Build site and check pages
         run: node site/build.mjs
+
+      - name: Upload Pages artifact
+        if: ${{ inputs.upload-dist }}
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: site/dist

.github/workflows/links.yml

@@ -15,6 +15,7 @@ permissions:
 jobs:
   links:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/pages.yml

@@ -14,41 +14,24 @@ permissions:
   pages: write
   id-token: write
 
+# One deploy at a time. A run in progress finishes; the next one queues
+# behind it rather than cancelling a production deploy halfway.
 concurrency:
   group: pages
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 jobs:
-  # The same tests, validation and page checks as a pull request runs.
-  validate:
-    uses: ./.github/workflows/ci.yml
-
+  # The same tests, validation and page checks as a pull request runs, with
+  # full git history, and the built site uploaded as the Pages artifact.
   build:
-    needs: validate
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # The sitemap's lastmod dates come from git history.
-          fetch-depth: 0
-
-      - name: Setup Node
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version-file: .nvmrc
-
-      - name: Build site
-        run: node site/build.mjs
-
-      - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
-        with:
-          path: site/dist
+    uses: ./.github/workflows/ci.yml
+    with:
+      upload-dist: true
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/reverify.yml

@@ -16,6 +16,7 @@ permissions:
 jobs:
   reverify:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/thumbs.yml

@@ -18,6 +18,7 @@ permissions:
 jobs:
   thumbs:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1