fix: restore the CI workflow and gitignore lost in the first push (#1)

The initial commit landed without any dotfile-prefixed paths, so the
repository has no CI at all: pushes to main neither build the site nor
deploy it, and pull requests run no checks.

Restores the deploy workflow, the dependabot config and the gitignore.
Untracks the two .pyc files that were committed as a side effect of the
missing gitignore.

Author: shenxianpeng

.github/dependabot.yml

@@ -0,0 +1,15 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/workflows/deploy.yml

@@ -0,0 +1,81 @@
+name: Deploy site
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  # The reference pages describe behaviour that lives in the commit-check
+  # repository, so they can drift without anything here changing. This job
+  # reads both and fails when they disagree.
+  docs-sync:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.x'
+
+      # Installed from main rather than PyPI: the site documents rule IDs that
+      # are merged but not yet released, so the published package would report
+      # a spurious mismatch. Switch this to the released package once a version
+      # carrying them is on PyPI.
+      - name: Install commit-check from main
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install pytest
+          python -m pip install "commit-check @ git+https://github.com/commit-check/commit-check@main"
+
+      - name: Check the docs against the package
+        run: pytest tests/ -q
+
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.x'
+
+      # The social plugin renders the share cards through cairo, which cairosvg
+      # loads at runtime rather than bundling.
+      - name: Install cairo
+        run: sudo apt-get install -y --no-install-recommends libcairo2
+
+      - name: Build site
+        run: pipx run nox -s docs
+
+      - name: Upload site as pages artifact
+        uses: actions/upload-pages-artifact@v5
+        with:
+          name: ${{ github.event.repository.name }}_site
+          path: ${{ github.workspace }}/site
+
+  deploy:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    needs: [build]
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v5
+        with:
+          artifact_name: ${{ github.event.repository.name }}_site

.gitignore

@@ -0,0 +1,15 @@
+# Build output
+site/
+
+# Social card cache
+.cache/
+
+# Python
+__pycache__/
+*.py[cod]
+.nox/
+.venv/
+
+# OS
+.DS_Store
+Thumbs.db