From 8b61be82fcf49b77ece396da1145b7ebcf97e1f1 Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Thu, 24 Sep 2026 20:04:50 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=8C=B1=20ci:=20add=20docs=20build=20gate?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a pull request and main build workflow that installs dependencies, runs lint, and builds the Next.js site. Pin meeting recording refresh workflow actions and scope write permissions to the committing job. Document local validation and preview commands for contributors.

Fixes #41

Fixes #42

Fixes #49

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 .github/workflows/build.yml                   | 38 +++++++++++++++++++
 .../workflows/meeting-recordings-refresh.yml  | 10 +++--
 CONTRIBUTING.md                               | 22 +++++++++++
 3 files changed, 66 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/build.yml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..cafd44f
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,38 @@
+name: Build
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: build-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Lint and build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          # ESLint 10 uses Node util.styleText, and jsdom 30 requires Node 22+.
+          node-version: "22"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint site
+        run: npm run lint
+
+      - name: Build site
+        run: npm run build
+        env:
+          NEXT_PUBLIC_BRANCH: main
diff --git a/.github/workflows/meeting-recordings-refresh.yml b/.github/workflows/meeting-recordings-refresh.yml
index 6332058..1f52610 100644
--- a/.github/workflows/meeting-recordings-refresh.yml
+++ b/.github/workflows/meeting-recordings-refresh.yml
@@ -6,24 +6,26 @@ on:
     - cron: '17 12 * * *'
 
 permissions:
-  contents: write
+  contents: read
 
 env:
   NETLIFY_BUILD_HOOK_URL: ${{ secrets.NETLIFY_BUILD_HOOK_URL }}
 
 jobs:
   refresh:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20.11.1'
           cache: npm
       - run: npm ci
       - run: npx tsx scripts/update-meeting-recordings.ts
       - name: Commit recording feed snapshot
-        uses: stefanzweifel/git-auto-commit-action@v6
+        uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
         with:
           commit_message: 'docs: refresh community meeting recordings'
           file_pattern: data/meeting-recordings.json
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index df06c27..7191565 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,3 +9,25 @@ Thank you for helping improve the Hive Commons documentation site
 - Site code, navigation, and layout changes belong in this repository.
 - Sign your commits with the DCO: `git commit -s`.
 - Open an issue at https://github.com/hivecommons/docs/issues for anything unclear.
+
+## Before you open a PR
+
+From a fresh checkout, install the exact dependency set and run the same local
+validation commands used by CI:
+
+```bash
+npm ci
+npm run lint
+npm run build
+```
+
+To preview the docs locally while editing, run:
+
+```bash
+npm run dev
+```
+
+Then open the local URL printed by Next.js, usually
+<http://localhost:3000>. For a production-style preview, run
+`npm run build` followed by `npm run start`.
+