Build and publish
The pipeline keeps native correctness, WebAssembly packaging, and static publishing as explicit phases so a broken browser artifact cannot silently deploy.
make clean && make && make test builds the raylib app and runs C tests for vectors, 100-day orbital accuracy, scene state, curved trail retention, camera, and renderer behavior. Build also checks the headless CLI, build graph, artifact validators, and address/undefined-behavior sanitizers.
make web compiles the raylib runtime, standalone conic kernel, and C-only comparison module with Emscripten. Artifact validation checks the bridges, WASM headers, and revision/checksum manifest. Astro owns the HTML documents.
Build stages all runtime assets, audits locked docs dependencies and pinned catalogs, compares native/WASM measurements, and runs Node tests, Astro build/type checks, route/sitemap checks, and sandboxed browser tests. It uploads the checked Pages tree for eligible main builds.
Deploy Pages accepts a successful same-repository main push or manual Build, downloads that run's checked site, verifies the runtime revision and checksums, and publishes without rebuilding Astro. An older build is skipped if main has advanced.
CodeQL separately analyzes C/C++, JavaScript/TypeScript, and GitHub Actions on main pushes, pull requests, a weekly schedule, and manual dispatch. Build uses read-only repository permissions and immutable action/raylib revisions; Pages write permissions belong only to its deployment job.
The footer identifies the site revision; build-info.json identifies the runtime revision and five artifact hashes. Only the canonical main build enables configured analytics, with the same setting used during validation.