Add Jekyll GitHub Pages deployment workflow

[Copilot]

Implements the GitHub Actions workflow from the-book-of-secret-knowledge#528 — builds and deploys a Jekyll site to GitHub Pages.

Changes

• .github/workflows/jekyll-gh-pages.yml — new workflow with two jobs:
  • build: checkout → configure Pages → Jekyll build → upload artifact
  • deploy: deploys artifact to GitHub Pages environment

Triggers on push to main and workflow_dispatch. Concurrency group "pages" prevents overlapping deployments without cancelling in-flight runs.

permissions:
  contents: read
  pages: write
  id-token: write

concurrency:
  group: "pages"
  cancel-in-progress: false

Original prompt

Pull request: trimstray/the-book-of-secret-knowledge#528

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a GitHub Actions workflow to build a Jekyll site and deploy it to GitHub Pages on pushes to main or manual dispatch.

Changes:

• Introduces a two-job GitHub Pages pipeline: build (Jekyll build + artifact upload) and deploy (Pages deployment).
• Configures token permissions required for Pages deployment.
• Adds concurrency control to prevent overlapping deployments.

[Copilot]

The comment is inaccurate: with cancel-in-progress: false, runs are serialized (queued) but not 'skipped'. Either adjust the comment to reflect queuing behavior, or (if the intent is to skip intermediate queued runs) set cancel-in-progress: true and update the text accordingly.

Suggested change

	# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
	# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
	# Allow only one concurrent deployment; additional runs are queued and executed serially.
	# Do NOT cancel in-progress runs, as we want to allow these production deployments to complete.

[Copilot]

The workflow is hard-coded to main, but the comment says 'default branch'. If main is the intended branch, update the comment to avoid misleading future maintainers.

Suggested change

	# Runs on pushes targeting the default branch
	# Runs on pushes targeting the main branch

[Copilot]

For supply-chain hardening, consider pinning GitHub Actions to a full commit SHA (instead of only major version tags). This reduces the risk of a compromised upstream tag affecting your workflow; you can still use Dependabot to keep pins updated.

Suggested change

	uses: actions/jekyll-build-pages@v1
	uses: actions/jekyll-build-pages@<FULL_40_CHARACTER_COMMIT_SHA> # pin trusted v1 release

[Copilot]

For supply-chain hardening, consider pinning GitHub Actions to a full commit SHA (instead of only major version tags). This reduces the risk of a compromised upstream tag affecting your workflow; you can still use Dependabot to keep pins updated.

Suggested change

	uses: actions/upload-pages-artifact@v3
	uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3

[Copilot]

For supply-chain hardening, consider pinning GitHub Actions to a full commit SHA (instead of only major version tags). This reduces the risk of a compromised upstream tag affecting your workflow; you can still use Dependabot to keep pins updated.

[Copilot]

The artifact upload step relies on upload-pages-artifact defaults for the upload path. Since the build explicitly sets destination: ./_site, consider setting with: path: ./_site here as well to keep the workflow resilient to future destination changes.

Suggested change

	uses: actions/upload-pages-artifact@v3
	uses: actions/upload-pages-artifact@v3
	with:
	path: ./_site