From 391e26d993a6649cef5d85edb696a996aa4ccdb6 Mon Sep 17 00:00:00 2001
From: Anyelo Petit <anyelopetit@gmail.com>
Date: Fri, 12 Jun 2026 17:00:22 -0400
Subject: [PATCH 1/4] ci: add build-check workflow running the production
 Jekyll build

---
 .github/workflows/build.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/build.yml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..093493f
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,33 @@
+name: Build
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # Reads Ruby version from .ruby-version and installs gems.
+      # bundler-cache: true runs bundle install (non-frozen) so it resolves the
+      # x86_64-linux platform that the darwin-only Gemfile.lock doesn't include.
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+
+      # Reads Node version from .nvmrc (18) and caches Yarn downloads.
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+
+      - run: yarn install --frozen-lockfile
+
+      # Exact command Netlify uses to publish the site (see netlify.toml).
+      # Plain `bundle exec jekyll build` fails — jekyll-postcss requires
+      # JEKYLL_ENV=production for a one-off build without the dev server.
+      - name: Build site
+        run: JEKYLL_ENV=production bundle exec jekyll build

From 61e7659c203911ff60c7c5bfb0da274fc9d72f2e Mon Sep 17 00:00:00 2001
From: Anyelo Petit <anyelopetit@gmail.com>
Date: Fri, 12 Jun 2026 17:16:26 -0400
Subject: [PATCH 2/4] chore: add x86_64-linux platform to Gemfile.lock for CI

---
 Gemfile.lock | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index aa2d97e..c309b0f 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -16,6 +16,7 @@ GEM
     execjs (2.9.1)
     ffi (1.17.2-arm64-darwin)
     ffi (1.17.2-x86_64-darwin)
+    ffi (1.17.2-x86_64-linux-gnu)
     forwardable-extended (2.6.0)
     google-protobuf (4.30.2-arm64-darwin)
       bigdecimal
@@ -23,6 +24,9 @@ GEM
     google-protobuf (4.30.2-x86_64-darwin)
       bigdecimal
       rake (>= 13)
+    google-protobuf (4.30.2-x86_64-linux)
+      bigdecimal
+      rake (>= 13)
     htmlcompressor (0.4.0)
     http_parser.rb (0.8.0)
     i18n (1.14.7)
@@ -87,6 +91,8 @@ GEM
       google-protobuf (~> 4.30)
     sass-embedded (1.87.0-x86_64-darwin)
       google-protobuf (~> 4.30)
+    sass-embedded (1.87.0-x86_64-linux-gnu)
+      google-protobuf (~> 4.30)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
     uglifier (4.2.0)
@@ -100,6 +106,7 @@ PLATFORMS
   arm64-darwin-24
   x86_64-darwin-21
   x86_64-darwin-23
+  x86_64-linux
 
 DEPENDENCIES
   http_parser.rb (~> 0.6.0)
@@ -114,4 +121,4 @@ DEPENDENCIES
   webrick (~> 1.7)
 
 BUNDLED WITH
-   2.3.22
+   2.5.22

From a5154fe520668bd4730a8397233aef470379b803 Mon Sep 17 00:00:00 2001
From: Martin Caetano <martin.caetano@icloud.com>
Date: Sat, 1 Aug 2026 20:21:10 -0300
Subject: [PATCH 3/4] Pin CI actions to immutable commits

---
 .github/workflows/build.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f4a5e29..3bbff7e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,16 +13,16 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       # Reads the Ruby version from .ruby-version, installs the locked bundle,
       # and caches the installed gems.
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
         with:
           bundler-cache: true
 
       # Reads Node version from .nvmrc (18) and caches Yarn downloads.
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version-file: .nvmrc
           cache: yarn

From 6d8caa958e011e8147374de928eddd4c07799bea Mon Sep 17 00:00:00 2001
From: Martin Caetano <martin.caetano@icloud.com>
Date: Sat, 1 Aug 2026 20:23:32 -0300
Subject: [PATCH 4/4] Harden repository checkout in CI

---
 .github/workflows/build.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3bbff7e..492c3c5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,7 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       # Reads the Ruby version from .ruby-version, installs the locked bundle,
       # and caches the installed gems.