CI: a Site workflow, and the firmware workflow skips changes that touch only the site and its documents

site.yml builds the site with a Zola pinned by its checksum and checks the
pages when site/, docs/, README.md or CONTEXT.md change. ci.yml gets
paths-ignore for the same files on pushes to main and on pull requests; a
tag always runs it (Gitea doesn't apply path filters to tags). A change
touching both runs both.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

.gitea/workflows/ci.yml

@@ -14,7 +14,11 @@ on:
   push:
     branches: [main]  # other branches are tested by their pull request: one run, not two
     tags: ['v*']
+    # A change that touches nothing but the site and the documents it is built from runs the Site
+    # workflow only (a tag always runs this one: Gitea doesn't apply path filters to tags).
+    paths-ignore: ['site/**', 'docs/**', 'README.md', 'CONTEXT.md']
   pull_request:
+    paths-ignore: ['site/**', 'docs/**', 'README.md', 'CONTEXT.md']
   workflow_dispatch:
     inputs:
       tag:

.gitea/workflows/site.yml

@@ -0,0 +1,49 @@
+# The project site (docs/milestones/W1.md): built with Zola to see that it builds and that its pages
+# are sound. Publishing is the maintainer's: the web server pulls main and runs `zola build`.
+#
+# It runs when the site, or a document the site is built from, changes (a pull request, or a push to
+# main); the firmware workflow (ci.yml) skips a change that touches only these files. A change that
+# touches both runs both.
+name: Site
+on:
+  push:
+    branches: [main]
+    paths: ['site/**', 'docs/**', 'README.md', 'CONTEXT.md', '.gitea/workflows/site.yml']
+  pull_request:
+    paths: ['site/**', 'docs/**', 'README.md', 'CONTEXT.md', '.gitea/workflows/site.yml']
+
+jobs:
+  build:
+    runs-on: ubuntu
+    # A pull request from a fork would run someone else's code on our runner: not without us.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    container:
+      image: python:3.12-slim
+    steps:
+      - name: Tools
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq --no-install-recommends git ca-certificates curl >/dev/null
+          # Zola, pinned by its checksum.
+          curl -fsSL -o /tmp/zola.tgz https://github.com/getzola/zola/releases/download/v0.22.0/zola-v0.22.0-x86_64-unknown-linux-gnu.tar.gz
+          echo "f1d491f8956b94384c27d75cb6b2bf60d3916d1ade9564bcbfe7c03f0258aebf  /tmp/zola.tgz" | sha256sum -c -
+          tar xzf /tmp/zola.tgz -C /usr/local/bin zola
+          zola --version
+
+      - name: Check out
+        run: |
+          find . -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git fetch -q origin '+refs/heads/*:refs/remotes/origin/*' '+refs/pull/*/head:refs/remotes/pull/*'
+          git checkout -q --detach "${{ github.sha }}"
+
+      - name: Build the site
+        run: |
+          cd site
+          zola check --skip-external-links
+          zola build --output-dir /tmp/site-out
+
+      - name: Check the pages
+        run: python3 site/tools/check_site.py /tmp/site-out