Feature: feat/judging-pool to dev

.github/labeler.yml

@@ -8,4 +8,4 @@ documentation:
   - head-branch: ["^doc/", "^docs/"]
 dependencies:
   - changed-files:
-      - any-glob-to-any-file: ["package.json", "package-lock.json", "bun.lockb"]
+      - any-glob-to-any-file: ["**/package.json", "pnpm-lock.yaml"]

.github/workflows/ci.yml

@@ -0,0 +1,109 @@
+name: CI/CD
+
+# One pipeline: every PR and every push to main/dev is linted, typechecked,
+# tested and built once. Hacklytics deploys only from that verified build —
+# a preview channel per PR, live on main. mainweb is not deployed here:
+# Firebase App Hosting builds it from main itself (apphosting.yaml).
+on:
+  push:
+    branches: ["main", "dev"]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Lint, typecheck, test, build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      # No version pin: the one in packageManager is the one that reads
+      # overrides and allowBuilds from pnpm-workspace.yaml. Pinning here
+      # silently installed an older pnpm that ignores both.
+      - uses: pnpm/action-setup@v5
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint and typecheck
+        run: pnpm turbo run lint typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build
+        run: pnpm turbo run build
+
+      - name: Upload Hacklytics build
+        uses: actions/upload-artifact@v4
+        with:
+          name: hacklytics-out
+          path: sites/hacklytics2027/out
+          retention-days: 3
+
+  preview-hacklytics:
+    name: Preview Hacklytics
+    needs: verify
+    # Forks and Dependabot get no repo secrets, so the deploy would fail on a
+    # missing service account. The verify job above still checks their build.
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: hacklytics-out
+          path: sites/hacklytics2027/out
+
+      - uses: FirebaseExtended/action-hosting-deploy@v0
+        with:
+          repoToken: ${{ secrets.GITHUB_TOKEN }}
+          firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_DSGT_WEBSITE }}
+          target: hacklytics
+          projectId: dsgt-website
+          channelId: pr-${{ github.event.pull_request.number }}
+          entryPoint: "."
+
+  deploy-hacklytics:
+    name: Deploy Hacklytics
+    needs: verify
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: hacklytics-out
+          path: sites/hacklytics2027/out
+
+      - uses: FirebaseExtended/action-hosting-deploy@v0
+        with:
+          repoToken: ${{ secrets.GITHUB_TOKEN }}
+          firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_DSGT_WEBSITE }}
+          target: hacklytics
+          projectId: dsgt-website
+          channelId: live
+          entryPoint: "."

.github/workflows/codeql.yml

@@ -83,16 +83,3 @@ jobs:
           comment-summary-in-pr: always
           vulnerability-check: true
 
-  security-summary:
-    name: Security Analysis Summary
-    needs: [analyze]
-    runs-on: ubuntu-latest
-    if: always()
-
-    steps:
-      - name: Generate Summary
-        run: |
-          echo "# Security Analysis Complete 🛡️" >> $GITHUB_STEP_SUMMARY
-          echo "The advanced CodeQL analysis and Dependency Review have finished." >> $GITHUB_STEP_SUMMARY
-          echo "All findings have been uploaded directly to the GitHub Security tab." >> $GITHUB_STEP_SUMMARY
-          echo "View detailed results at: https://github.com/${{ github.repository }}/security/code-scanning" >> $GITHUB_STEP_SUMMARY

docs/operations/ci-cd.md

@@ -2,25 +2,25 @@
 
 All workflows live in `.github/workflows/`.
 
-## Quality
+## Pipeline
 
-| Workflow | Trigger | What it does |
-| --- | --- | --- |
-| `pnpm-ci.yml` | Push `main`/`dev`, PRs | `pnpm install` + `pnpm turbo run build` (Node 22) |
-| `test.yml` | Push `main`/`dev`, PRs | `pnpm test` (Node 22; pnpm comes from `packageManager`, unpinned in the workflow so it cannot drift) |
-| `codeql.yml` | Push/PR `main`/`dev`, daily 02:00 UTC | CodeQL `security-extended,security-and-quality`; PRs also run dependency review (`fail-on-severity: high`) |
+`ci.yml` is the one CI/CD pipeline, on every PR and every push to `main`/`dev`:
+
+1. `verify` — `pnpm install --frozen-lockfile`, then `turbo run lint typecheck`, `pnpm test`, `turbo run build` (Node from `.nvmrc`; pnpm from `packageManager`, unpinned in the workflow so it cannot drift). Uploads `sites/hacklytics2027/out`.
+2. `preview-hacklytics` — PRs from this repo (not forks, not Dependabot): deploys that build to Firebase Hosting channel `pr-N`.
+3. `deploy-hacklytics` — push to `main` only: deploys the same build to the live `hacklytics` target.
 
-## Deploy
+Both deploy jobs `need` `verify`, so nothing ships that failed lint, typecheck, tests, or build.
 
-| Workflow | Trigger | Target |
+## Security
+
+| Workflow | Trigger | What it does |
 | --- | --- | --- |
-| `deploy-hacklytics.yml` | Push `main` and PRs | Firebase Hosting `hacklytics` (live vs `pr-N`) |
-| `firebase-hosting-merge.yml` | Push `main` | Same live Hacklytics deploy |
-| `firebase-hosting-pull-request.yml` | PRs (same-repo only) | Hacklytics preview channel |
+| `codeql.yml` | Push/PR `main`/`dev`, daily 02:00 UTC | CodeQL `security-extended,security-and-quality`; PRs also run dependency review (`fail-on-severity: high`) |
 
-Mainweb production is **Firebase App Hosting**, not these Hosting workflows. App Hosting builds from `apphosting.yaml` when the connected branch updates.
+## Mainweb deploy
 
-`deploy-hacklytics.yml.disabled` is a leftover disabled copy.
+Mainweb production is **Firebase App Hosting**, not `ci.yml`. App Hosting builds from `apphosting.yaml` when the connected branch updates, independent of whether `verify` passed — the gate is the `main` ruleset, so require the `Lint, typecheck, test, build` check there.
 
 ## Branch automation
 

docs/operations/testing.md

@@ -12,7 +12,7 @@ That is:
 vitest run packages/api packages/db sites/mainweb/lib
 ```
 
-CI: `.github/workflows/test.yml` on pushes to `main`/`dev` and on pull requests.
+CI: the `verify` job in `.github/workflows/ci.yml` on pushes to `main`/`dev` and on pull requests.
 
 ## `@query/api`
 
@@ -55,7 +55,7 @@ Playwright (`@playwright/test`). `scripts/capture-vision.ts` is a visual capture
 
 ## What “green” means
 
-`pnpm test` does **not** run `pnpm lint`, `pnpm typecheck`, or `pnpm build`. CI build is a separate workflow (`pnpm-ci.yml`). Run all four before a release-quality PR:
+`pnpm test` does **not** run `pnpm lint`, `pnpm typecheck`, or `pnpm build`. CI runs all four in the `verify` job of `ci.yml`. Run all four before a release-quality PR:
 
 ```bash
 pnpm lint && pnpm typecheck && pnpm test && pnpm build

docs/sites/hacklytics2027.md

@@ -46,11 +46,7 @@ Interest requires a portal account (verified email). The CTA is:
 
 Firebase Hosting target `hacklytics`, public dir `sites/hacklytics2027/out` (`firebase.json`).
 
-Workflows:
-
-- `.github/workflows/deploy-hacklytics.yml` — build filter `hacklytics2027`, deploy target `hacklytics` (live on `main`, preview channel `pr-N` on PRs)
-- `.github/workflows/firebase-hosting-merge.yml` — same live deploy on `main`
-- `.github/workflows/firebase-hosting-pull-request.yml` — PR preview channels
+Workflow: `.github/workflows/ci.yml`. The `verify` job builds every site; `deploy-hacklytics` ships that build live on `main` and `preview-hacklytics` to channel `pr-N` on PRs. Neither runs unless `verify` passes.
 
 Asset caching: hashed JS/CSS/fonts/images `max-age=31536000, immutable`; HTML `max-age=3600`. See `firebase.json`.