feat(actions): publish Wiki and context artifacts

[fishmingyu]

Parent: #415
Depends on: #418, #420, #421

Summary

Provide a reusable GitHub Action and callable Pages workflow that build CodeNib repository context once, export a secret-free static Wiki, and publish the exact commit-addressed index artifact for later MCP reuse.

The default path works for a public repository without an external model: BM25-backed deterministic Wiki export. Semantic construction is an explicit opt-in using either a local Hugging Face model or a caller-selected OpenAI-compatible embedding endpoint. GitHub Models is not part of the design because GitHub retired the service on 2026-07-30.

User Surface

A repository needs only a small caller workflow pinned to a CodeNib release:

permissions:
  contents: read
  pages: write
  id-token: write
jobs:
  wiki:
    uses: sysevol-ai/CodeNib/.github/workflows/codenib-pages.yml@<release-sha>

Callers select preset: semantic for local Hugging Face embeddings. A remote endpoint additionally selects embedding-provider: openai, supplies its public model/endpoint identity, and passes an optional secret through embedding_api_key. No secret-bearing capability runs on untrusted fork code or pull_request_target.

Design

Reusable build action

• install one pinned CodeNib package/action revision;
• restore the latest compatible repository-state cache;
• run the incremental compiler;
• export at the requested Pages base path;
• validate repository, commit, schema, and capabilities;
• scan static output and artifact metadata for configured secrets;
• save an immutable cache key and upload a commit-addressed context artifact;
• expose manifest, site, commit, cache-hit, and capability outputs.

Callable Pages workflow

• checkout the caller repository with complete commit identity;
• use only contents and Pages permissions;
• invoke the build action;
• upload and deploy the static site through the github-pages environment;
• serialize deployments through a repository-scoped concurrency group.

Cache and artifact identity

Cache compatibility includes CodeNib revision, platform, Python, selected preset, and provider/model/dimension identity. A cache restore is only a candidate: the compiler still validates source and manifest state before incrementally updating it.

The downloadable artifact name includes repository and commit. The archive contains the manifest and view files but never credentials. M4 adds the fetch/rebind command that combines this artifact with a checkout of the same commit for MCP.

Security

• Default triggers are push and workflow_dispatch, not pull_request_target.
• The no-model and local-model paths receive no provider credential.
• BYO credentials are scoped to the publish process and withheld from forks.
• Logs, outputs, cache keys, manifests, uploaded context artifacts, and Pages files contain no token values.
• Endpoint URLs with userinfo, query strings, or fragments are rejected.
• Third-party actions are pinned to immutable commit SHAs.

Acceptance Criteria

• A fixture public repository builds and exports with no model credential.
• Local Hugging Face and mocked OpenAI-compatible semantic routes resolve to the correct dependency and credential boundaries.
• A second commit restores state and exercises the incremental compiler path.
• Static output works under both / and a project Pages base path.
• The uploaded artifact identifies the exact repository commit and contains the manifest plus selected views.
• Fork/untrusted event tests prove BYO steps cannot receive a credential.
• Secret regression tests scan output, metadata, cache keys, and logged command arguments.
• Workflow/action schema tests validate required permissions, immutable action pins, concurrency, and output wiring.
• Local Action smoke plus the relevant unit/Web tests pass.
• Documentation explains model-download cost, provider opt-ins, cache invalidation, and deterministic fallback.

Delivery

Use a temporary integration base that composes H1 and H2 while their PRs are reviewed. Keep H3 limited to Action/workflow, portable artifact staging, tests, and deployment docs. Rebase onto main and retarget after #418, #420, and #421 land.

Effort

effort/large

[fishmingyu]

H3 implementation is available in draft PR #423. It is stacked on the temporary integration/hosted-product review base because the Action composes #418, #420, and #421; the PR will be restacked onto main after those dependencies merge.

Local acceptance evidence:

• full unit tier: 2627 passed, 10 skipped
• pre-commit: passed
• composite/workflow action-validator: passed
• MkDocs strict build: passed
• frontend and source-wheel builds: passed

The implementation binds cache and artifact identity to the indexed checkout commit, exposes a no-model BM25 route, scopes GitHub Models/BYO credentials to semantic builds, and publishes a hash-inventoried portable serving artifact distinct from mutable incremental cache state.