Overhaul MeshCore Canada: task-first journeys, structured communities, and safer delivery

.github/workflows/apply-approved-boundary.yml

@@ -25,14 +25,14 @@ jobs:
 
     steps:
       - name: Checkout current authority
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           ref: main
           fetch-depth: 0
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
 
@@ -122,7 +122,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          node scripts/validate-regions.js
+          node scripts/validate-regions.cjs
           python scripts/verify-region-geometry.py
           python scripts/verify-region-geometry.py \
             --partition docs/assets/regions/canada-region-partition-digital.geojson

.github/workflows/deploy-reviewed-site.yml

@@ -0,0 +1,57 @@
+name: Deploy reviewed site
+
+on:
+  workflow_run:
+    workflows: ["Validate site quality"]
+    types: [completed]
+    branches: [main]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: meshcore-ca-pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout validated revision
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: requirements-docs.txt
+
+      - name: Set up Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Build the validated revision
+        env:
+          MCC_SITE_REVISION: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          python -m pip install -r requirements-docs.txt
+          npm ci
+          npm run docs:build
+          node scripts/check-built-links.mjs
+
+      - name: Deploy to GitHub Pages
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./.tmp/site
+          cname: meshcore.ca

.github/workflows/quality.yml

@@ -0,0 +1,156 @@
+name: Validate site quality
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: site-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: |
+            requirements-docs.txt
+            scripts/requirements-regions.txt
+            tools/region-proposal-gateway/requirements.txt
+
+      - name: Set up Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install locked dependencies
+        run: |
+          python -m pip install -r requirements-docs.txt
+          python -m pip install -r scripts/requirements-regions.txt
+          python -m pip install -r tools/region-proposal-gateway/requirements.txt
+          npm ci
+
+      - name: Enforce source and production boundaries
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -z "$(git ls-files site)"
+          if git grep -n -E 'canadaverse\.org|regions-api\.meshcore\.ca|/api/meshcore-regions/proposals|192\.168\.0\.(24|111)|/home/neonx|splashpage' -- \
+            docs/config/editor docs/javascripts docs/submit-idea.md \
+            tools/region-proposal-gateway instructions.md; then
+            echo 'Production submission files contain staging infrastructure.' >&2
+            exit 1
+          fi
+
+      - name: Validate content and generated directories
+        run: |
+          python scripts/validate-content.py
+          python scripts/validate-communities.py
+          python scripts/validate_community_submission.py
+          python -m unittest discover -s tests/content -p "test_*.py" -v
+          npm run test:content
+
+      - name: Validate region authority and proposal automation
+        run: |
+          node scripts/validate-regions.cjs
+          python scripts/verify-region-geometry.py
+          python scripts/verify-region-geometry.py --partition docs/assets/regions/canada-region-partition-digital.geojson
+          python -m unittest discover -s tools/region-proposal-gateway/tests -v
+          python -m unittest discover -s tests/automation -v
+          npm run test:editor
+
+      - name: Check browser JavaScript syntax
+        shell: bash
+        run: |
+          set -euo pipefail
+          for file in docs/config/editor/*.js docs/assets/javascripts/*.js docs/assets/regions/modules/*.js docs/assets/regions/regions.js; do
+            node --check "$file"
+          done
+
+      - name: Build and audit local links
+        run: npm run check:links
+
+      - name: Check patch hygiene
+        run: git diff --check
+
+  browser:
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: requirements-docs.txt
+
+      - name: Set up Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install site and browser dependencies
+        run: |
+          python -m pip install -r requirements-docs.txt
+          npm ci
+          npx playwright install --with-deps chromium firefox webkit
+
+      - name: Build site
+        run: npm run docs:build
+
+      - name: Run critical journeys and accessibility checks
+        run: npm run test:browser
+
+  lighthouse:
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: requirements-docs.txt
+
+      - name: Set up Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install locked dependencies
+        run: |
+          python -m pip install -r requirements-docs.txt
+          npm ci
+
+      - name: Enforce Lighthouse budgets
+        shell: bash
+        run: |
+          export CHROME_PATH="$(command -v google-chrome || command -v google-chrome-stable)"
+          npm run audit:lighthouse