ci: validate pull requests before they merge

[krassx]

The workflow only triggered on pushes to main, so content PRs could not be validated until after they merged.

That's not hypothetical — #13 merged clean and immediately turned main red, because three spelling issues had no opportunity to surface earlier. #15's description had to carry a "merge #14 first" note for the same reason.

What changes

Pull requests now run the same checkout / install / spell-check / build steps a deploy runs, and stop before touching AWS.

Reusing the single existing job — rather than adding a separate validation workflow — means a PR necessarily runs exactly what the deploy will run. A second workflow would be free to drift from it.

The three AWS steps are guarded with github.event_name != 'pull_request', so a PR run performs no OIDC exchange, no S3 sync, and no CloudFront invalidation.

Two deliberate choices

No paths-ignore on the PR trigger, unlike push. Skipping a deploy for a change that can't affect the built site is worthwhile; skipping validation isn't. A workflow or config change is precisely what's worth checking on the PR, and the run is cheap.

Concurrency is unaffected. github.ref is refs/pull/<n>/merge on a PR, so validation runs get their own group and can't cancel an in-flight deploy of main.

One thing worth your call

id-token: write stays declared at workflow level and is simply unused on PR runs, since every AWS step is skipped. Scoping it to a deploy-only job would require either a second build or passing the build output between jobs as an artifact. Happy to do that if the broader permission on PR runs bothers you — I kept the diff minimal instead.

Verified

YAML parses, and the trigger/guard structure is as intended:

triggers: [ 'pull_request', 'push', 'workflow_dispatch' ]
  Checkout                          if=—
  Setup Node.js                     if=—
  Install dependencies              if=—
  Spell check                       if=—
  Build site                        if=—
  Configure AWS credentials (OIDC)  if=github.event_name != 'pull_request'
  Sync to S3                        if=github.event_name != 'pull_request'
  Invalidate CloudFront             if=github.event_name != 'pull_request'

This PR should be its own proof: once open, it ought to run the validation job and stop short of deploying.

🤖 Generated with Claude Code