Add public Forgejo static site deploy action

README.md

@@ -0,0 +1,64 @@
+# Static Site Deploy
+
+A small, dependency-free Forgejo Action that synchronizes a completed static
+website build to a dedicated Bunny Storage Zone.
+
+The deployer requires `index.html`, rejects symbolic links, compares files with
+a checksum manifest, uploads changed assets before HTML, deletes stale files
+only after successful uploads, and publishes the new manifest last.
+
+## Forgejo Actions
+
+Store the website-specific Storage Zone password as the repository secret
+`BUNNY_STORAGE_PASSWORD`, then pin the action to an immutable commit from the
+public action repository:
+
+```yaml
+---
+name: Deploy website
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  deploy:
+    runs-on: docker
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v6
+      - run: npm ci
+      - run: npm run build
+      - name: Deploy to Bunny
+        uses: https://forge.tionis.dev/actions/static-site-deploy@<commit-sha>
+        with:
+          directory: dist
+          storage-zone: example-org
+        env:
+          BUNNY_STORAGE_PASSWORD: ${{ secrets.BUNNY_STORAGE_PASSWORD }}
+```
+
+Only run deployments for trusted branches. A contributor able to change a
+workflow that receives production secrets can attempt to expose those secrets.
+
+## Command line
+
+The script can also be used directly with Python 3.11 or newer:
+
+```bash
+export BUNNY_STORAGE_ZONE=example-org
+export BUNNY_STORAGE_PASSWORD='zone-specific password'
+python3 static_site.py bunny dist --dry-run
+python3 static_site.py bunny dist
+```
+
+Set `BUNNY_STORAGE_ENDPOINT` when the Storage Zone is outside Frankfurt.
+
+## Development
+
+```bash
+python3 -m pytest tests
+```
+
+The canonical source lives in the private Gandalf infrastructure repository
+and is published to this repository as a Git subtree.