[Seungpyo1007]

Summary

Brings back CI and the Pages deploy with no personal access token anywhere. Every job runs on this repository's read-only GITHUB_TOKEN; the only write is the Pages deploy. TechEngineBot is used in exactly one place: the comment of a final check a maintainer asks for.

Change

• pages.yml: on a push to main (a merged release PR) or by hand. It validates the data, generates site/public/v1, openapi.json and data/_verify/status.json with the pinned TechEngine, checks every collection's counts against data/, builds the site and deploys it. A manual run on any other branch is a dry run.
• pr-checks.yml: every PR into develop or main. It runs the bundled validator, TechEngine's validator on the changed records (every record when the pin moves), the integrity gate, a Tier 0 report and, when site/ changes, the site build. Results go to the job summary and file annotations; it never comments.
• final-check.yml: when a maintainer adds the final-check label. It builds everything pages.yml would publish from the PR, and TechEngineBot posts one comment with the verdict, edited in place on re-runs. Only the comment job sees TECHENGINEBOT_TOKEN, and it refuses anything but a fine-grained token of TechEngineBot. Fork PRs get no comment.
• dependabot.yml: the TechEngine submodule bump (weekly) and grouped action updates (monthly), at most one open PR each, into develop.
• The generated API is no longer committed (about 315k files). .gitignore keeps only the hand-made v1/games/index.json pointer. The unanchored build/ and env/ rules that hid v1/software/build and v1/software/env are now anchored to the root.
• build-history.mjs: the growth chart now continues from the commits that changed data/ after the last committed manifest.
• Docs: the README covers the new workflows and local preview. The PR template no longer promises automatic sidebar metadata.

All actions are pinned by SHA. Engine steps run with every proxy pointed at a closed port, so they cannot reach third-party sites.

Not changed

• No schedules, comment commands, pull_request_target, cross-repo dispatch, PR-opening jobs, or crawls.
• TechEngine's reusable workflows are not called. The engine runs at the pinned submodule commit.
• This supersedes ci: add a label-triggered final check commented by TechEngineBot #375 and ci: rebuild Actions on GITHUB_TOKEN with TechEngine reusable workflows #376.

Settings (applied by hand, not in this diff)

Actions was re-enabled just before this PR opened, so pr-checks runs on it:

• GitHub-owned actions only, with SHA pinning required.
• A read-only GITHUB_TOKEN that cannot approve PRs.
• Approval required for runs from external contributors.
• An Actions policy that allows only push, pull_request and workflow_dispatch, triggered by Seungpyo1007 or dependabot[bot].

Check

• Offline locally on the pinned engine: the bundled validator, the engine validator, integrity_check.py --strict and app.verify status all passed. The regenerated status.json differs from the committed one only in generated_at. A smoke dump of brands and socs passed.
• check_dump.py on the committed dump fails only software (42,493 records but 42,491 pages), which is the ignored build/env defect this fixes.
• The final-check report script was run locally for the pass and failure cases. Backticks and @ are removed from quoted logs.
• These workflows have not run on GitHub yet. The first run will be a pages.yml dry run on develop after merge.

Closes #297

[Copilot]

Copilot review overview

No open issues 🎉

_{Review effort: Balanced}