SRRCON.org site v2: GitHub Actions + enhanced dev exp with Rake tasks and tests

.editorconfig

@@ -0,0 +1,33 @@
+# EditorConfig helps maintain consistent coding styles across different editors
+# https://editorconfig.org
+
+root = true
+
+# Universal settings
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+# Markdown files - preserve trailing spaces (for line breaks)
+[*.md]
+trim_trailing_whitespace = false
+
+# YAML files
+[*.{yml,yaml}]
+indent_size = 2
+
+# Ruby files
+[*.{rb,rake}]
+indent_size = 2
+
+# HTML/CSS/JS files
+[*.{html,css,js,json}]
+indent_size = 2
+
+# Makefiles require tabs
+[Makefile]
+indent_style = tab

.github/copilot-instructions.md

@@ -0,0 +1,55 @@
+# Copilot instructions for SRCCON
+
+## Big picture architecture
+
+- This repo is a Jekyll site, not an app server: source content + templates compile into `_site/` (`Rakefile` `build`, `.github/workflows/test.yml`).
+- Page content is mostly root-level Markdown (for example `homepage.md`) with frontmatter driving layout/navigation behavior.
+- Liquid composition pattern:
+  - Layouts in `_layouts/` (for example `_layouts/layout_hub.html`) wrap `{{ content }}`.
+  - Shared fragments live in `_includes/`.
+  - Structured content lives in `_data/*.yml`.
+- Collections are configured in `_config.yml` (`transcripts`, `share`) and output to permalinked paths.
+- Legacy material exists in `_archive/`; prefer editing current root pages, `_layouts/`, `_includes/`, `_data/`, and collection content unless asked to update archive files.
+
+## Workflow commands agents should use
+
+- Setup/runtime baseline: Ruby `.ruby-version` and Bundler.
+- Primary local loop: `bundle exec rake default` (`build` + `check` + `serve`).
+- If you need a fresh output directory first: run `bundle exec rake clean` before `build`/`default`.
+- Build-only when debugging rendering: `bundle exec rake build`.
+- Config/data guardrail before deeper edits: `bundle exec rake check` (depends on `validate_yaml`).
+- Full local validation suite: `bundle exec rake test` (aggregate task in `tasks/test.rake`).
+- `bundle exec rake test:sessions` exists but is currently a placeholder and is not included in aggregate `rake test`.
+- Formatting:
+  - `bundle exec rake lint` for checks (StandardRB + Prettier).
+  - `bundle exec rake format` for autofix (StandardRB + Prettier).
+
+## Project-specific conventions (enforced by tasks)
+
+- Root markdown pages should include frontmatter `section` and `permalink` (`test:page_config`).
+- In Liquid templates, prefer `page.root_url`; `site.root_url` is treated as an error except legacy `_includes/prior_events.html` (`test:templates`).
+- Liquid href style matters: `href="{{variable}}"` is warned on; `{{ page.url }}`-style spacing/object references are expected (`test:templates`).
+- (Template checks intentionally skip some file paths)
+
+## Validation nuances and CI differences
+
+- `test:html_proofer` checks built output in `_site/` and aborts if `_site/` does not exist.
+- Local `test:html_proofer` enforces HTTPS links (`enforce_https: true` in `tasks/test.rake`).
+- CI `test.yml` intentionally runs htmlproofer with `--no-enforce-https`; do not assume parity with local failures.
+- YAML validation is stricter than syntax-only: `validate_yaml` also detects duplicate keys using Psych AST traversal in `Rakefile`.
+- `rake check` reports configuration errors (template bucket/distribution defaults) but currently does not `abort`; use it as a guardrail signal, not a hard gate.
+
+## Deployment boundaries and integrations
+
+- Deployment settings come from `_config.yml` → `deployment.bucket`, `deployment.staging_bucket`, `deployment.cloudfront_distribution_id`.
+- Branch-driven behavior in `.github/workflows/deploy.yml`:
+  - `staging` push syncs `_site/` to staging S3.
+  - `main` push syncs production S3 and invalidates CloudFront.
+- Local deploy tasks in `Rakefile` default to dry runs (`deploy:staging`, `deploy:production`) and require explicit confirmation for real deploys.
+- AWS auth uses GitHub OIDC with `AWS_ROLE_ARN`; avoid adding static credentials.
+
+## Editing guidance for agents
+
+- Keep edits minimal and aligned with existing Liquid/Jekyll patterns; do not introduce new frameworks/toolchains.
+- For template/frontmatter/data changes, run targeted checks first (`check`, `test:templates`, `test:page_config`) before `rake test`.
+- If modifying deploy logic, update both Rake deploy tasks and matching GitHub workflow behavior to keep local/CI intent consistent.

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+
+updates:
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    open-pull-requests-limit: 5
+
+  # Ruby gems (Bundler)
+  - package-ecosystem: "bundler"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "ruby"
+    open-pull-requests-limit: 5
+    versioning-strategy: increase

.github/workflows/deploy.yml

@@ -0,0 +1,78 @@
+name: Deploy to S3
+
+on:
+  push:
+    branches:
+      - main
+      - staging
+
+permissions:
+  contents: read
+  id-token: write # Required for OIDC authentication
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ".ruby-version"
+          bundler-cache: true
+
+      - name: Validate YAML files
+        run: bundle exec rake validate_yaml
+
+      - name: Build Jekyll site
+        run: bundle exec jekyll build
+
+      - name: Extract deployment config from _config.yml
+        id: config
+        run: |
+          mapfile -t DEPLOYMENT_VALUES < <(ruby -ryaml -e "config = YAML.safe_load_file('_config.yml', permitted_classes: [], aliases: true); deployment = config['deployment'] || {}; puts deployment['bucket'].to_s; puts deployment['staging_bucket'].to_s; puts deployment['cloudfront_distribution_id'].to_s")
+          BUCKET="${DEPLOYMENT_VALUES[0]}"
+          if [ -z "$BUCKET" ]; then
+            echo "Error: S3 bucket name not configured. Please set deployment.bucket in _config.yml." >&2
+            exit 1
+          fi
+          STAGING_BUCKET="${DEPLOYMENT_VALUES[1]}"
+          if [ -z "$STAGING_BUCKET" ]; then
+            echo "Error: Staging bucket name not configured. Please set deployment.staging_bucket in _config.yml." >&2
+            exit 1
+          fi
+          CLOUDFRONT="${DEPLOYMENT_VALUES[2]}"
+          echo "bucket=$BUCKET" >> $GITHUB_OUTPUT
+          echo "staging_bucket=$STAGING_BUCKET" >> $GITHUB_OUTPUT
+          echo "cloudfront=$CLOUDFRONT" >> $GITHUB_OUTPUT
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+          role-session-name: Deploy-${{ github.event.repository.name }}-${{ github.run_id }}
+
+      - name: Deploy to S3 (Staging)
+        if: github.ref == 'refs/heads/staging'
+        run: |
+          aws s3 sync _site/ s3://${{ steps.config.outputs.staging_bucket }} \
+            --delete \
+            --cache-control "public, max-age=3600"
+
+      - name: Deploy to S3 (Production)
+        if: github.ref == 'refs/heads/main'
+        run: |
+          aws s3 sync _site/ s3://${{ steps.config.outputs.bucket }} \
+            --delete \
+            --cache-control "public, max-age=3600"
+
+      - name: Invalidate CloudFront (Production)
+        if: github.ref == 'refs/heads/main' && steps.config.outputs.cloudfront != ''
+        run: |
+          aws cloudfront create-invalidation \
+            --distribution-id ${{ steps.config.outputs.cloudfront }} \
+            --paths "/*"

.github/workflows/health-check.yml

@@ -0,0 +1,79 @@
+name: Weekly Health Check
+
+on:
+  schedule:
+    - cron: "0 12 * * 1" # Every Monday at noon UTC
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  health-check:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ".ruby-version"
+          bundler-cache: true
+
+      - name: Check for outdated dependencies
+        run: |
+          echo "=== Checking for outdated gems ==="
+          bundle outdated || true
+
+      - name: Validate YAML files
+        run: bundle exec rake validate_yaml
+
+      - name: Build Jekyll site
+        run: bundle exec jekyll build --verbose
+
+      - name: Validate build output
+        run: |
+          if [ ! -d "_site" ]; then
+            echo "ERROR: _site directory not created"
+            exit 1
+          fi
+
+          if [ ! -f "_site/index.html" ]; then
+            echo "ERROR: index.html not found in _site"
+            exit 1
+          fi
+
+          echo "✅ Build validation passed"
+
+      - name: Create issue on failure
+        if: failure()
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const title = '🚨 Weekly health check failed';
+            const body = `The scheduled template validation failed on ${new Date().toISOString()}.
+
+            **Workflow Run:** ${context.payload.repository.html_url}/actions/runs/${context.runId}
+
+            Please investigate the failure and update dependencies as needed.`;
+
+            // Check if issue already exists
+            const issues = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: 'automated,health-check'
+            });
+
+            if (issues.data.length === 0) {
+              await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title: title,
+                body: body,
+                labels: ['automated', 'health-check', 'bug']
+              });
+            }

.github/workflows/test.yml

@@ -0,0 +1,81 @@
+name: Test Build
+
+on:
+  push:
+    branches-ignore:
+      - main
+      - staging
+  pull_request:
+    branches:
+      - main
+      - staging
+
+permissions:
+  contents: read
+  id-token: write # Required for OIDC authentication
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ".ruby-version"
+          bundler-cache: true
+
+      - name: Validate YAML files
+        run: bundle exec rake validate_yaml
+
+      - name: Build Jekyll site
+        run: bundle exec jekyll build --verbose
+
+      - name: Validate HTML and check links
+        run: |
+          bundle exec htmlproofer ./_site \
+            --disable-external \
+            --no-enforce-https \
+            --ignore-urls "/^http:\/\/(127\.0\.0\.1|0\.0\.0\.0|localhost)/" \
+            --allow-hash-href
+
+      - name: Extract deployment config from _config.yml
+        if: github.event_name == 'pull_request' && env.AWS_ROLE_ARN != '' && github.repository != 'OpenNews/srccon-site-starterkit'
+        id: config
+        env:
+          AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
+        run: |
+          STAGING_BUCKET=$(ruby -ryaml -e "config = YAML.safe_load_file('_config.yml', permitted_classes: [], aliases: true); puts config['deployment']['staging_bucket']")
+          echo "staging_bucket=$STAGING_BUCKET" >> $GITHUB_OUTPUT
+
+      - name: Configure AWS credentials
+        if: github.event_name == 'pull_request' && env.AWS_ROLE_ARN != '' && github.repository != 'OpenNews/srccon-site-starterkit'
+        uses: aws-actions/configure-aws-credentials@v6
+        env:
+          AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+          role-session-name: Test-${{ github.event.repository.name }}-${{ github.run_id }}
+
+      - name: Test deployment (dry-run)
+        if: github.event_name == 'pull_request' && env.AWS_ROLE_ARN != '' && github.repository != 'OpenNews/srccon-site-starterkit'
+        env:
+          AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
+        run: |
+          echo "Testing S3 sync command (dry-run)..."
+          aws s3 sync _site/ s3://${{ steps.config.outputs.staging_bucket }} \
+            --dryrun \
+            --delete \
+            --cache-control "public, max-age=3600"
+
+      - name: Skip deployment test (no credentials or GitHub Pages repo)
+        if: github.event_name == 'pull_request' && (env.AWS_ROLE_ARN == '' || github.repository == 'OpenNews/srccon-site-starterkit')
+        env:
+          AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
+        run: |
+          echo "⏭️  Skipping S3 deployment test in this build context"
+          echo "This is normal for Dependabot PRs and external contributions."

.gitignore

@@ -1,3 +1,26 @@
+# Jekyll build outputs
+_site/
+.jekyll-cache/
+.sass-cache/
+tmp/
+
+# Ruby/Bundler
+.bundle/
+vendor/
+
+# Node.js
+node_modules/
+
+# OS files
 .DS_Store
-_site
-.jekyll-cache
+Thumbs.db
+
+# Editor files (but allow .vscode/ and .editorconfig for team shared settings)
+.idea/
+*.swp
+*.swo
+*~
+
+# Local environment
+.env
+.env.local