ci: harden the build and API-pages workflows (#843)

* ci: serialise image builds and stop the API-pages workflow clobbering the lockfile

build_n_push: add a per-ref concurrency group so two quick merges to main can't race the :main tag (last push wins regardless of commit order, and the server auto-pulls :main); add permissions: contents: read; validate .dockerignore and package.json changes in the PR path filter.

generate_api_pages: pin Node 20 and switch npm install -> npm ci so the run can never rewrite the now-tracked package-lock.json with a divergent macOS-resolved tree; stage only src/pages/ipa/resources instead of git add -A; drop --force from the push — a force-push from this workflow would silently rewrite main and destroy any PR merged since its checkout.

* chore: warn when per-page dates are skipped; drop dead per-file git lookup

buildGitDateMap now logs a warning when it emits no dates (git missing or shallow clone) instead of silently blanking every page's Updated line and the sitemap lastmod entries; document the squash-merge assumption behind the --name-only walk. Remove the unused getGitLastModified. Note in CLAUDE.md that npm run start warns under output: 'standalone'. Gen output verified byte-identical.

* ci: self-heal the API-pages push when main moves mid-run

Rebase the single generated-files commit onto the moved branch before pushing, so a PR merged during the multi-minute run no longer rejects the push (the failure --force was presumably papering over). A genuine conflict — a concurrent edit of the generated files themselves — still fails the run loudly with main untouched. Also serialise dispatches with a concurrency group: run history shows several same-day dispatches, and overlapping runs regenerate the same files.

Sandbox-tested against a bare repo: plain push rejected on race; rebase+push lands with both commits intact; true conflict exits 1 leaving the branch tip untouched.

* ci: sync to branch tip before regenerating API pages

A run queued behind another checks out the commit pinned at its dispatch time; regenerating against that stale base means the pre-push rebase replays a snapshot diff, and a file the newer spec removed can silently survive from the prior run. Fetch + reset to the branch tip before generating so the diff is computed against reality. Also note the latest-dispatched-vs-newest-tag caveat on the concurrency comment.

Sandbox-proven: with the old order a removed-in-newer-spec file survives the rebase replay; with sync-first it is gone.

* Prevent stale workflows from overwriting newer published content

* Coderabbit Fix

---------

Co-authored-by: Brandon Hopkins <brandon@techhut.tv>

scripts/git-dates.mjs

@@ -1,25 +1,5 @@
 import { execSync } from 'child_process'
 
-/**
- * Get the last modified date for a file from git history.
- * Returns YYYY-MM-DD or null if the file is not tracked / git is unavailable.
- *
- * Prefer buildGitDateMap() when you need dates for many files — this spawns a
- * git process per call, which is ~300x slower across a full page tree.
- */
-export function getGitLastModified(filePath) {
-  try {
-    const date = execSync(`git log -1 --format=%cI -- "${filePath}"`, {
-      encoding: 'utf-8',
-      stdio: ['pipe', 'pipe', 'ignore'],
-    }).trim()
-
-    return date ? date.split('T')[0] : null
-  } catch {
-    return null
-  }
-}
-
 let _dateMapCache
 
 /**
@@ -31,22 +11,28 @@ let _dateMapCache
  * most recent commit — the same value `git log -1 -- <path>` returns. Paths are
  * repo-relative with forward slashes, matching path.relative(repoRoot, file).
  *
- * Returns an empty map if git is unavailable (e.g. inside the Docker image,
- * which has no git binary) or the checkout is shallow; callers then fall back
- * to no date, exactly as the per-file getGitLastModified() did.
+ * Note: `git log --name-only` lists no files for merge commits, so content
+ * introduced by a conflict-resolving merge is attributed to its source
+ * commits. That matches this repo's squash-merge workflow; revisit with
+ * `--diff-merges=first-parent` if long-lived branches are ever merged.
+ *
+ * Returns an empty map — with a warning, since every page then renders without
+ * an "Updated" date and the sitemap loses <lastmod> — when git is unavailable
+ * or the checkout is shallow (e.g. actions/checkout without fetch-depth: 0,
+ * where git log would attribute one identical, wrong date to every file).
  */
 export function buildGitDateMap() {
   if (_dateMapCache) return _dateMapCache
   const map = new Map()
   try {
-    // On a shallow clone (e.g. actions/checkout without fetch-depth: 0) git log
-    // only sees the fetched commits, so every file would report the same wrong
-    // date. Emit no dates rather than wrong ones.
     const shallow = execSync('git rev-parse --is-shallow-repository', {
       encoding: 'utf-8',
       stdio: ['pipe', 'pipe', 'ignore'],
     }).trim()
     if (shallow === 'true') {
+      console.warn(
+        '[git-dates] shallow clone detected — emitting no per-page dates (fetch full history to enable them)'
+      )
       _dateMapCache = map
       return map
     }
@@ -68,8 +54,10 @@ export function buildGitDateMap() {
       }
       if (currentDate && !map.has(line)) map.set(line, currentDate)
     }
-  } catch {
-    // git unavailable — return the empty map, callers fall back to null.
+  } catch (err) {
+    console.warn(
+      `[git-dates] could not read git history — emitting no per-page dates: ${err.message}`
+    )
   }
   _dateMapCache = map
   return map