feat(site): publish this repository's decision portal at adrkit.dev/decisions/ (#294)

[mbeacom]

Closes #294 once a deploy is seen serving /decisions/.

What and why

This is ADR-0054's rung-2 dogfood: this repository's own decision portal on adrkit.dev. #224 doesn't block it. #224 only blocks upgrading Starlight, and the portal is an independent static bundle.

• Build: site.yml runs the shipped Action, uses: ./packages/ci/portal, so the committed dist/portal-action.js runs exactly as it does for consumers. The bundle goes into site/dist/decisions/ after astro build, which empties dist on every build, so nothing stale survives. A guard confirms no Starlight route produced dist/decisions.
• Check: scripts/check-portal-bundle.ts checks the page files, that portal-data.json is version: "1", that references are relative only (clause 8), and that the record count equals adr lint's checked count (59 == 59). It uses lint's count rather than a filename glob, so core's definition of a record file isn't restated.
• Exit codes (clause 9):
  • Exit 1 publishes with a warning.
  • A refusal or exit 2 fails the build on pull requests.
  • On main, a portal failure still publishes the site and schema, then turns the run red from the deploy job (ADR-0011).
• Links: from the generated decision-records index and the CI page. A sidebar entry would need astro.config.mjs, which the site: Starlight 0.42 build fails — satteri native binding unresolvable from the prerender bundle under the isolated linker #224 Starlight fix owns.
• Existing bug fixed in the same file: on main, a failed rendered check exited the build job before the Pages upload, which held back the schema deploy, contrary to the step's own comment and DEPLOYMENT.md. Rendered and portal failures now share one mechanism: publish, then report from the deploy job.

Checklist

• DCO signed off.
• Recorded decision: ADR-0054 clauses 8, 9, and 12, plus ADR-0011. Item 8 stays unticked until a real deploy is seen.
• Schema, packages/ci, or core: n/a.
• Observed failing first (ADR-0016): the bundle check exits 1 with a specific message for each of six planted defects, and four mutations of the check fail its tests.
• actionlint, the rendered self-test (27 planted defects caught), bun test (4360 pass), typecheck, lint, check:deps, check:stale-refs, check:site-grammar, and check:doc-pins pass.

Notes for reviewers

• Gate: this touches .github/workflows/site.yml, so it needs gate-change-acknowledged.
• Local end to end: I built the site, ran the committed bundle, and served site/dist. /decisions/#/queue, #/graph, and #/adr/0054 load under the page's CSP.
• When a portal or rendered failure turns a main run red, the github-pages deployment shows as failed even though the site is live. DEPLOYMENT.md says so.
• Favicon 404 under /decisions/: tracked in portal: the page has no icon, so browsers request /favicon.ico and get a 404 #309.

[Copilot]

🟡 Changes recommended

The bundle validator can accept missing runtime modules and invalid excess record counts.

1 open finding

• Include statically imported vendor modules in bundle validation · New

What changed in this PR

Publishes the repository’s decision portal at /decisions/, validates its generated bundle, and preserves schema deployment when portal/render checks fail.

Changes:

• Builds and verifies the portal during site deployment.
• Defers non-blocking failure reporting until after deployment.
• Adds portal links and operational documentation.

File	Description
.github/​workflows/​site.yml	Builds, checks, and deploys the portal.
scripts/​check-portal-bundle.ts	Validates generated portal output.
scripts/​check-portal-bundle.test.ts	Tests bundle validation.
site/​scripts/​gen-adr-pages.ts	Links the records index to the portal.
site/​src/​content/​docs/​ci.mdx	Documents the dogfood deployment.
site/​DEPLOYMENT.md	Documents deployment and recovery behavior.
CHANGELOG.md	Records the new portal deployment.
AGENTS.md	Updates portal evidence status.

🧠 Review effort: Balanced

[github-actions]

Decisions governing this change

9 accepted decisions govern this change

• 0007 — Isolate integrations as optional adapters and build only against public surfaces
  • via path: .github/workflows/**
• 0010 — Use Bun as the package manager and test runner while publishing Node-targeted artifacts
  • via path: .github/workflows/**
• 0011 — Host the canonical JSON Schema at its $id on adrkit.dev
  • via path: .github/workflows/site.yml
  • via path: site/**
• 0025 — Ship badges as recipes over existing output, not a new CLI surface
  • via path: .github/workflows/site.yml
• 0026 — Identify the CI comment by the strongest author evidence the token allows
  • via path: site/src/content/docs/ci.mdx
• 0033 — Select interactive graph presentation at the CLI boundary while preserving piped DOT
  • via path: site/src/content/docs/**
• 0035 — Execute the gates that certify a pull request from the default branch
  • via path: .github/workflows/**
  • via path: scripts/**
• 0037 — Treat generated knowledge systems as downstream read models, not decision authorities
  • via path: site/src/content/docs/**
• 0040 — Keep derived surfaces in lockstep with three mechanisms matched to three classes of drift
  • via path: AGENTS.md

_{Links point at a081938, this run's GITHUB_SHA. Run adr explain <path> locally to see why a file is governed.}