GitHub Actions (CI/CD)

.github/workflows/deploy.yml is what turns a merged pull request into a live site. On every push to main it:

1. Installs dependencies with npm ci
2. Builds the Astro site
3. Runs a security job — npm audit and dependency review — as a merge gate
4. Deploys the built site to GitHub Pages

The workflow that ships in this repo is deliberately unhardened in one place: a third-party Action pinned only by tag, and a broader-than-needed permissions block. That's the CI/CD half of the supply-chain story — the pipeline that builds and deploys your code needs the same scrutiny as the code itself.