Publish dev and prod builds to plg.wallacenet.ca (Cloudflare Pages)

Both workflows gain a deploy-pages job that stages their channel into one
Pages site, carrying the other channel over from the live site. The in-app
updater now reads /prod|/dev/latest.json from plg.wallacenet.ca instead of
the GitHub API. GitHub releases are still published for one transition
deployment so existing installs can fetch the new updater.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdMNbY5hLR7FjtfEE712xG

.github/workflows/ci.yml

@@ -30,6 +30,8 @@ jobs:
   build:
     name: Build and check
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.stage.outputs.version }}
     env:
       # Stamp the APK as a dev-channel build exactly when it is a build of the
       # dev branch, which is exactly when it can be published below. Pull
@@ -108,6 +110,15 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "apk=$dest" >> "$GITHUB_OUTPUT"
 
+      - name: Upload staged dev APK for the Pages deploy
+        if: github.ref == 'refs/heads/dev'
+        uses: actions/upload-artifact@v4
+        with:
+          name: plg-dev-staged
+          path: ${{ steps.stage.outputs.apk }}
+          if-no-files-found: error
+          retention-days: 1
+
       - name: Publish dev channel prerelease
         if: github.ref == 'refs/heads/dev'
         env:
@@ -125,3 +136,42 @@ jobs:
           Preview build: newer than production, and less tested. Switch to the
           Dev update channel in Settings to be offered these. Marked as a
           prerelease so production-channel installs never see it."
+
+  # Publishes the build to https://plg.wallacenet.ca (Cloudflare Pages). Runs
+  # alongside the GitHub release above for one deployment so already-installed
+  # apps, which still read GitHub, can fetch the updater that reads Cloudflare.
+  #
+  # Both workflows deploy into one Pages site, and a deploy replaces the whole
+  # site, so they share a concurrency group and never run at the same time.
+  deploy-pages:
+    name: Deploy to Cloudflare Pages
+    needs: build
+    if: github.ref == 'refs/heads/dev'
+    runs-on: ubuntu-latest
+    concurrency:
+      group: plg-pages-deploy
+      cancel-in-progress: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download staged APK
+        uses: actions/download-artifact@v4
+        with:
+          name: plg-dev-staged
+          path: staged
+
+      - name: Assemble site
+        run: .github/scripts/stage-pages-site.sh dev "${{ needs.build.outputs.version }}" "staged/ProLibertateGames-${{ needs.build.outputs.version }}.apk"
+
+      - name: Deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          set -euo pipefail
+          # Creates the project on first run; fails harmlessly if it exists.
+          npx --yes wrangler@3 pages project create plg --production-branch main || true
+          # --branch main makes this the production deployment, which is what
+          # plg.wallacenet.ca serves, whichever branch the workflow ran on.
+          npx --yes wrangler@3 pages deploy pages-out --project-name plg --branch main --commit-dirty=true