InKCre · xiaoland · Aug 9, 2026 · Aug 9, 2026
diff --git a/.github/pages-preview-closed/_headers b/.github/pages-preview-closed/_headers
@@ -0,0 +1,3 @@
+/*
+  Cache-Control: no-store
+  X-Robots-Tag: noindex, nofollow
diff --git a/.github/pages-preview-closed/index.html b/.github/pages-preview-closed/index.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="robots" content="noindex, nofollow" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Preview closed</title>
+  </head>
+  <body>
+    <main>
+      <h1>This preview is closed</h1>
+      <p>The pull request is no longer open.</p>
+    </main>
+  </body>
+</html>
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -4,6 +4,11 @@ on:
   pull_request:
     branches:
       - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   workflow_dispatch:
 
 permissions:
@@ -44,3 +49,12 @@ jobs:
       - name: Require a package changeset
         if: github.event_name == 'pull_request'
         run: pnpm changeset:check origin/${{ github.base_ref }}
+
+      - name: Upload the checked Histoire artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ui-web-histoire
+          path: packages/web/.histoire/dist
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 7
diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml
@@ -0,0 +1,158 @@
+name: Histoire deployment
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build exact main Histoire release
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    outputs:
+      artifact_digest: ${{ steps.artifact.outputs['artifact-digest'] }}
+      head_sha: ${{ steps.identity.outputs.head_sha }}
+    steps:
+      - name: Resolve exact current main source
+        id: identity
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const currentMain = await github.rest.git.getRef({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              ref: 'heads/main',
+            })
+            if (currentMain.data.object.sha !== context.sha) {
+              core.setFailed('A newer main revision superseded this delivery run.')
+              return
+            }
+            core.setOutput('head_sha', context.sha)
+
+      - name: Checkout exact main source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ steps.identity.outputs.head_sha }}
+          persist-credentials: false
+
+      - name: Install the pinned pnpm release
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: 11.17.0
+
+      - name: Set up Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 22.22.3
+          cache: pnpm
+
+      - name: Install the frozen workspace
+        run: pnpm install --frozen-lockfile
+
+      - name: Build the focused Histoire release
+        run: pnpm story
+
+      - name: Upload the exact Histoire release artifact
+        id: artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ui-web-histoire
+          path: packages/web/.histoire/dist
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 30
+
+      - name: Record Histoire release provenance
+        env:
+          ARTIFACT_DIGEST: ${{ steps.artifact.outputs['artifact-digest'] }}
+          RELEASE_HEAD_SHA: ${{ steps.identity.outputs.head_sha }}
+        run: |
+          {
+            echo '## UI Histoire release'
+            echo
+            echo "- Source SHA: \`${RELEASE_HEAD_SHA}\`"
+            echo "- Workflow run: \`${GITHUB_RUN_ID}\`"
+            echo '- Artifact: `ui-web-histoire`'
+            echo "- Artifact digest: \`${ARTIFACT_DIGEST}\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  deploy:
+    name: ui-web deployment
+    needs: build
+    concurrency:
+      group: ui-web-deployment-main
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      deployments: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment:
+      name: production
+      url: https://design.inkcre.dev
+    steps:
+      - name: Checkout the exact delivery controller
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.build.outputs.head_sha }}
+          path: controller
+          persist-credentials: false
+
+      - name: Install the pinned pnpm release
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: 11.17.0
+
+      - name: Set up Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 22.22.3
+          cache: pnpm
+          cache-dependency-path: controller/pnpm-lock.yaml
+
+      - name: Install the trusted delivery toolchain
+        run: pnpm --dir controller install --frozen-lockfile
+
+      - name: Download the same-run Histoire release artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ui-web-histoire
+          path: .pages-delivery/dist
+
+      - name: Reverify main before delivery
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          RELEASE_HEAD_SHA: ${{ needs.build.outputs.head_sha }}
+        with:
+          script: |
+            const currentMain = await github.rest.git.getRef({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              ref: 'heads/main',
+            })
+            if (currentMain.data.object.sha !== process.env.RELEASE_HEAD_SHA) {
+              core.setFailed('Main changed after the Histoire build; refusing delivery.')
+            }
+
+      - name: Deploy the exact Histoire release artifact
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          RELEASE_HEAD_SHA: ${{ needs.build.outputs.head_sha }}
+        run: >-
+          pnpm --dir controller exec wrangler pages deploy
+          "$GITHUB_WORKSPACE/.pages-delivery/dist"
+          --project-name="${{ vars.CLOUDFLARE_PAGES_PROJECT }}"
+          --branch=main
+          --commit-hash="$RELEASE_HEAD_SHA"
+          --commit-dirty=false
+
+      - name: Smoke-test design.inkcre.dev
+        env:
+          INKCRE_PAGES_MODE: production
+          INKCRE_PAGES_URL: https://design.inkcre.dev
+        run: node controller/scripts/verify-pages-deployment.mjs
diff --git a/.github/workflows/pages-preview-cleanup.yml b/.github/workflows/pages-preview-cleanup.yml
@@ -0,0 +1,69 @@
+name: Histoire preview cleanup
+
+on:
+  pull_request_target:
+    branches:
+      - main
+    types:
+      - closed
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ui-web-preview-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  cleanup:
+    name: ui-web preview cleanup
+    if: >-
+      github.event.pull_request.base.ref == 'main' &&
+      github.event.pull_request.base.repo.full_name == github.repository &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: read
+      deployments: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment:
+      name: preview
+      url: https://pr-${{ github.event.pull_request.number }}.design-dd4.pages.dev
+    steps:
+      - name: Checkout the trusted cleanup controller
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.workflow_sha }}
+          persist-credentials: false
+
+      - name: Install the pinned pnpm release
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: 11.17.0
+
+      - name: Set up Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 22.22.3
+          cache: pnpm
+
+      - name: Install the trusted delivery toolchain
+        run: pnpm install --frozen-lockfile
+
+      - name: Replace the preview alias with a closed marker
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          PREVIEW_BRANCH: pr-${{ github.event.pull_request.number }}
+        run: >-
+          pnpm exec wrangler pages deploy .github/pages-preview-closed
+          --project-name="${{ vars.CLOUDFLARE_PAGES_PROJECT }}"
+          --branch="$PREVIEW_BRANCH"
+          --commit-hash="${{ github.workflow_sha }}"
+          --commit-dirty=false
+
+      - name: Verify the closed preview marker
+        env:
+          INKCRE_PAGES_MODE: closed
+          INKCRE_PAGES_URL: https://pr-${{ github.event.pull_request.number }}.design-dd4.pages.dev
+        run: node scripts/verify-pages-deployment.mjs