ci: build-check on PRs + gate Pages deploy on release

.bun-version

@@ -0,0 +1 @@
+1.3.14

.github/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: CI
+
+# Build verification only — runs on PRs and pushes to main.
+# Does NOT deploy. Production deploy is gated on publishing a release
+# (see deploy.yml, triggered on `release: published`).
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: .bun-version
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build website
+        run: bun run build

.github/workflows/deploy.yml

@@ -1,8 +1,10 @@
 name: Deploy to GitHub Pages
 
+# Production deploy is gated on publishing a GitHub release.
+# Build verification on PRs / main pushes lives in ci.yml.
 on:
-  push:
-    branches: [main]
+  release:
+    types: [published]
   workflow_dispatch:
 
 permissions:
@@ -29,7 +31,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version-file: .bun-version
 
       - name: Install dependencies
         run: bun install

package.json

@@ -1,7 +1,7 @@
 {
   "name": "libredb-studio-website",
   "type": "module",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "scripts": {
     "dev": "astro dev",
     "build": "node scripts/sync-docker-compose.mjs && astro build",