ci: stage the site with write_source_files instead of shell

Replaces the cp -RL plus two chmod passes with 'bazel run //:stage_site', using
write_source_files from aspect_bazel_lib -- already a dependency, so no new
module. It is used here as a directory-copy primitive rather than for its usual
round-tripping purpose, so diff_test and the destination-exists check are off:
out/ is build output, not something checked in.

Three measured improvements over the shell it replaces:

- Writes 644/755 directly, so the post-hoc chmod normalisation is gone. The
  deploy job commits this tree, and Bazel's own outputs are 555, so that
  compensation was load-bearing -- now it is simply not needed.
- Does not reach into bazel-bin, a convenience symlink that --symlink_prefix can
  move or suppress.
- Removes files that are no longer part of the site. cp left them; verified by
  planting a stale file and re-running.

Considered rules_pkg's pkg_install for the same job. write_source_files wins on
handling directory outputs natively -- both bundles are tree artifacts, which is
the fiddly part of pkg_files -- and on adding no dependency.

Verified end to end: the staged artifact is 38 files, content and modes
identical to the pre-migration CI output.

Author: afq984

.github/workflows/actions.yml

@@ -22,15 +22,11 @@ jobs:
       run: bazel test //...
     - name: Build site
       run: bazel build //:site
-    # bazel-bin is a symlink into the output base, and the artifact upload does
-    # not follow it, so stage the tree. Bazel's outputs are mode 555; the deploy
-    # job commits this tree to gh-pages, so normalise to 644/755 or every file
-    # would land marked executable.
+    # Materializes //:site into out/. Writes 644/755 directly, so the deploy job
+    # does not commit a tree of executables, and does not depend on the bazel-bin
+    # convenience symlink.
     - name: Stage site
-      run: |
-        mkdir -p out && cp -RL bazel-bin/site/. out/
-        find out -type d -exec chmod 755 {} +
-        find out -type f -exec chmod 644 {} +
+      run: bazel run //:stage_site
     - uses: actions/upload-artifact@v4
       with:
         name: out

.gitignore

@@ -1,2 +1,5 @@
 # Bazel convenience symlinks into the output base.
 /bazel-*
+
+# Staged site output from `bazel run //:stage_site`.
+/out/

BUILD.bazel

@@ -25,3 +25,18 @@ copy_to_directory(
     root_paths = ["src"],
     visibility = ["//visibility:public"],
 )
+
+load("@aspect_bazel_lib//lib:write_source_files.bzl", "write_source_files")
+
+# Materializes //:site into out/ for the CI artifact upload: `bazel run //:stage_site`.
+# Used as a directory-copy primitive rather than for its usual round-tripping
+# purpose, so the staleness test and the destination-exists check are off -- out/
+# is build output, not something checked in. Unlike a shell copy this writes
+# 644/755 without post-hoc chmod, does not reach into the bazel-bin symlink, and
+# removes files that are no longer part of the site.
+write_source_files(
+    name = "stage_site",
+    files = {"out": "//:site"},
+    check_that_out_file_exists = False,
+    diff_test = False,
+)