From 1b95f2b990c86fc8952b19bf53b4f7d90579cf97 Mon Sep 17 00:00:00 2001
From: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
Date: Tue, 10 Nov 2026 13:11:28 -0800
Subject: [PATCH] Fail Pages deploys that do not go live

actions/deploy-pages uses GITHUB_SHA as the Pages build version. Pages runs on main, so every deploy between merges reuses one version and the status check reports success right away. One deploy reported success but Pages kept serving the previous site, so a preview stayed stale with a green job.

Assemble now adds marker files at a path unique to the run attempt. After deploying, the job polls a different marker each time until one is served, and fails after 5 minutes. Fresh paths avoid 404s cached by the CDN, which ignores query strings.

Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
---
 .github/workflows/pages.yml | 25 ++++++++++++++++++++++++-
 docs/README.md              |  3 ++-
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index c88ed14..648969a 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -34,6 +34,7 @@ jobs:
     timeout-minutes: 30
     outputs:
       trusted-sha: ${{ steps.revision.outputs.sha }}
+      marker: ${{ steps.marker.outputs.path }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -51,6 +52,13 @@ jobs:
       - run: node scripts/site-ci.ts assemble
         env:
           GH_TOKEN: ${{ github.token }}
+      # The CDN caches 404s, so each deploy check polls a path nobody requested before.
+      - id: marker
+        run: |
+          marker="deploy-marker/$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "site/$marker"
+          for n in $(seq 1 30); do echo "$n" > "site/$marker/$n"; done
+          echo "path=$marker" >> "$GITHUB_OUTPUT"
       - uses: actions/upload-pages-artifact@v5
         with:
           path: site/
@@ -92,4 +100,19 @@ jobs:
           GH_TOKEN: ${{ github.token }}
       - name: Deploy current site
         id: deployment
-        uses: actions/deploy-pages@v5
\ No newline at end of file
+        uses: actions/deploy-pages@v5
+      # Pages can report success and keep serving the previous deployment.
+      - name: Require Pages to serve this deployment
+        env:
+          SITE_URL: ${{ steps.deployment.outputs.page_url }}
+          MARKER: ${{ needs.assemble.outputs.marker }}
+        run: |
+          for n in $(seq 1 30); do
+            if curl -fs --max-time 10 -o /dev/null "${SITE_URL%/}/$MARKER/$n"; then
+              echo "Pages serves this deployment after $n checks"
+              exit 0
+            fi
+            sleep 10
+          done
+          echo "::error::Pages still serves an older deployment. Rerun the deploy job."
+          exit 1
\ No newline at end of file
diff --git a/docs/README.md b/docs/README.md
index 00d3f94..a3c641c 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -115,7 +115,8 @@ Pages skips a preview whose build lacks `index.html`, contains symbolic links, h
 
 Publication calls Pages after a main push or a data change. Pages also runs for
 successful preview builds and preview eligibility changes. Run Pages manually
-after a direct push to `data`.
+after a direct push to `data`. The deploy job fails if the site still serves an
+older deployment after 5 minutes. Rerun the deploy job.
 
 Publication and Pages use serial queues with up to 100 pending jobs or runs each.
 Benchmark checks ignore unrelated labels and title or body edits.