[kubbot]

Replace the failing user-token push with the official GitHub Pages artifact deployment protocol, while preserving the existing published website. The current Pages source is the compiled gh-pages tree; main contains a Docsy scaffold without its old documentation content, so publishing main/public would remove existing pages.

• Keep the real main-source install/lint/build checks. For delivery, check out the existing gh-pages snapshot, record its Git byte tree, and construct artifact.tar only from tracked regular files and directories. This retains all existing pages/assets and dotfile markers.
• Upload and download that exact artifact with official GitHub actions, then compare all paths, bytes, hashes and executable flags before deployment. Symlinks, hardlinks, traversal, omitted, extra and duplicate entries fail verification.
• Publish only for trusted main pushes or manual main runs through the existing github-pages environment. Pull requests only build and verify. The configured URL https://openkf.github.io/website/ is guarded; no domain, secret value or gh-pages branch is changed.

The main branch remains a build-validation source. Content updates for this legacy site still come from gh-pages and require a main push or a manual workflow run on main; moving real content to main is a separate migration.

Validation on head 8e5769764d55816622886617ab6adfa299e06539:

• Actual Pages artifact roundtrip succeeded: snapshot b2aead1 / tree 2a35407, all 223 files and 94 directory entries preserved through upload, download and byte/hash/mode verification. Artifact 13012340087 has identical upload/download SHA256. Deployment was intentionally skipped for this PR.
• Three-platform Docsy CI and CodeQL succeeded on the same head.
• After the real PR workflow, the live Pages setting is still legacy with its original URL/CNAME/HTTPS and unchanged gh-pages ref. Configure-pages used only the reviewed GET path.
• Local validation covered17 actual Git/tar protocol cases and staticchecks; no host dependency installation or build. Three existing public routes returned 200 and matched their Git blob bytes before the migration.

Actual production deployment and after-route acceptance remain separate: the maintainer must first apply the reviewed existing-site switch to workflow mode and merge. The existing main environment policy already permits this flow.

Refs: GET-325.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
website	Ready	Preview	Oct 30, 2026 9:00pm UTC

[kubbot]

Reviewed the full three-file Pages migration and artifact verifier. The existing published gh-pages byte tree is preserved; main scaffold is only built for validation. Actual PR artifact upload/download and all 223 file hashes/paths/modes matched, plus three-OS Docsy, CodeQL and Vercel gates. PR deployment is intentionally skipped by the reviewed main-only guard; this is not a production deployment pass. The existing Pages URL and branch are retained; live deployment and old-route hashes will be read back after landing.