--- paths: ["website/**"] --- # Website — build, deploy, and the encoding fences ## Deploy **Since 2026-10-30 (D35 / R-1228) the public site is served by Cloudflare Pages** (project `felhom-site`): a push to `main` reaches the public site only after `sec run CF_PAGES_TOKEN -- scripts/publish-site-cloudflare.sh` (`--dry-run` first; it uploads `website/` from `main` and `/scripts/` from the installer tag). DooPlex's git-sync copy keeps tracking `main` as the way back (`documentation/audits/release-2026-10-30/p3-cloudflare/PLAN.md` §5). No image build. **Do NOT pin the website to the installer tag.** The sparse-checkout used to cover `/website/` and `/scripts/` in one sync; pinning that would turn every copy edit into a release. The installer's tag-based publishing is a separate mechanism — see the R-110 fence in the repo core `CLAUDE.md`. ## Gates Website changes go through `python3 scripts/repo_gates.py`, which runs `site_gates.py`. **A new page must be registered in that gate** — in `TWINS` together with its English twin, or by name in `NO_TWIN` — or it is unchecked (and the gate's walk refuses it). `site_gates.py` asserts: BOM, emoji, nav/footer consistency **per language set**, analytics, CDN, design tokens, no embedded `