From 77fb72fa45bd43c505e3b42ba25aebf5c2d7fb85 Mon Sep 17 00:00:00 2001
From: Petr Plenkov <petr.plenkov@gmail.com>
Date: Wed, 12 Aug 2026 00:52:36 +0200
Subject: [PATCH 1/3] feat: add pre-alpha disclaimers and Cloudflare Pages
 deploy workflow

- README.md: pre-alpha warning banner (APIs may change, not production-ready)
- website Base.astro: amber pre-alpha banner on all 4 pages
- website global.css: banner styling (dark amber theme)
- .github/workflows/deploy-website.yml: Cloudflare Pages deployment
  via wrangler-action@v4, triggers on push to main (website/** path filter)
  and manual workflow_dispatch

Requires repo secrets: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/workflows/deploy-website.yml | 36 ++++++++++++++++++++++++++++
 README.md                            |  3 +++
 website/src/layouts/Base.astro       |  3 +++
 website/src/styles/global.css        | 10 ++++++++
 4 files changed, 52 insertions(+)
 create mode 100644 .github/workflows/deploy-website.yml

diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
new file mode 100644
index 000000000..523236373
--- /dev/null
+++ b/.github/workflows/deploy-website.yml
@@ -0,0 +1,36 @@
+name: Deploy website
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "website/**"
+      - ".github/workflows/deploy-website.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  deployments: write
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    name: Deploy to Cloudflare Pages
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install and build
+        working-directory: website
+        run: |
+          bun install --frozen-lockfile
+          bun run build
+
+      - name: Deploy to Cloudflare Pages
+        uses: cloudflare/wrangler-action@v4
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy website/dist --project-name=sverka
+          gitHubToken: ${{ secrets.GITHUB_TOKEN }}
diff --git a/README.md b/README.md
index ea14631a6..cd92a8d83 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,9 @@
 A composable workflow SDK, local CI runtime, and multi-target compiler
 for software verification.
 
+> **⚠️ Pre-alpha — Work in progress.** Sverka is under active development.
+> APIs may change without notice. Not ready for production use.
+
 [Website](https://sverka.dev) &middot; [Documentation](https://sverka.dev/docs) &middot; [CLI Reference](https://sverka.dev/docs/cli)
 
 </div>
diff --git a/website/src/layouts/Base.astro b/website/src/layouts/Base.astro
index b1e58d9a7..8a767803b 100644
--- a/website/src/layouts/Base.astro
+++ b/website/src/layouts/Base.astro
@@ -35,6 +35,9 @@ const {
     <meta name="twitter:description" content={description} />
   </head>
   <body>
+    <div class="pre-alpha-banner">
+      ⚠️ Pre-alpha — Work in progress. APIs may change. Not ready for production use.
+    </div>
     <slot />
     <footer>
       <p>
diff --git a/website/src/styles/global.css b/website/src/styles/global.css
index d0c2ae8cc..741373ef3 100644
--- a/website/src/styles/global.css
+++ b/website/src/styles/global.css
@@ -30,6 +30,16 @@ body {
   flex-direction: column;
 }
 
+.pre-alpha-banner {
+  background: #2a1a0a;
+  border-bottom: 1px solid #4a3a1a;
+  color: #e8a040;
+  text-align: center;
+  padding: 0.5rem 1rem;
+  font-size: 0.85rem;
+  font-weight: 500;
+}
+
 main {
   flex: 1;
   max-width: var(--max-width);

From ddb6c12dfaa9af0bc444609a3821f41d9fb71507 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 12 Aug 2026 06:26:14 +0000
Subject: [PATCH 2/3] fix(review): harden deploy workflow and pre-alpha banner
 accessibility

- Pin runner (ubuntu-24.04) and action SHAs.
- Pin Bun 1.3.14 and Wrangler 4.121.0 versions.
- Add workflow concurrency with cancel-in-progress.
- Disable checkout credential persistence.
- Remove gitHubToken and deployments:write permission.
- Split install/build so build failures stop before deploy.
- Add role="status" and aria-hidden emoji wrapper to banner.

Co-Authored-By: Petr Plenkov <petr.plenkov@gmail.com>
---
 .github/workflows/deploy-website.yml | 29 +++++++++++++++++-----------
 website/src/layouts/Base.astro       |  4 ++--
 2 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index 523236373..9d31445e2 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -1,5 +1,9 @@
 name: Deploy website
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main]
@@ -10,27 +14,30 @@ on:
 
 permissions:
   contents: read
-  deployments: write
 
 jobs:
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Deploy to Cloudflare Pages
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.3.14"
 
-      - uses: oven-sh/setup-bun@v2
+      - name: Install website dependencies
+        run: bun --cwd=${{ github.workspace }}/website install --frozen-lockfile
 
-      - name: Install and build
-        working-directory: website
-        run: |
-          bun install --frozen-lockfile
-          bun run build
+      - name: Build website
+        run: bun --cwd=${{ github.workspace }}/website run build
 
       - name: Deploy to Cloudflare Pages
-        uses: cloudflare/wrangler-action@v4
+        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          wranglerVersion: "4.121.0"
           command: pages deploy website/dist --project-name=sverka
-          gitHubToken: ${{ secrets.GITHUB_TOKEN }}
diff --git a/website/src/layouts/Base.astro b/website/src/layouts/Base.astro
index 8a767803b..bc08f33b5 100644
--- a/website/src/layouts/Base.astro
+++ b/website/src/layouts/Base.astro
@@ -35,8 +35,8 @@ const {
     <meta name="twitter:description" content={description} />
   </head>
   <body>
-    <div class="pre-alpha-banner">
-      ⚠️ Pre-alpha — Work in progress. APIs may change. Not ready for production use.
+    <div class="pre-alpha-banner" role="status">
+      <span aria-hidden="true">⚠️</span> Pre-alpha — Work in progress. APIs may change. Not ready for production use.
     </div>
     <slot />
     <footer>

From 5c8e31da35fa97bc9248c92c714fc49ae42cde36 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 12 Aug 2026 06:36:14 +0000
Subject: [PATCH 3/3] fix(review): disable Bun cache and align banner text

- Add no-cache: true to oven-sh/setup-bun to prevent cache poisoning.
- Update pre-alpha banner text to include "without notice" matching README.md.

Co-Authored-By: Petr Plenkov <petr.plenkov@gmail.com>
---
 .github/workflows/deploy-website.yml | 1 +
 website/src/layouts/Base.astro       | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index 9d31445e2..ea43d27e6 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -27,6 +27,7 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: "1.3.14"
+          no-cache: true
 
       - name: Install website dependencies
         run: bun --cwd=${{ github.workspace }}/website install --frozen-lockfile
diff --git a/website/src/layouts/Base.astro b/website/src/layouts/Base.astro
index bc08f33b5..c0958afa7 100644
--- a/website/src/layouts/Base.astro
+++ b/website/src/layouts/Base.astro
@@ -36,7 +36,7 @@ const {
   </head>
   <body>
     <div class="pre-alpha-banner" role="status">
-      <span aria-hidden="true">⚠️</span> Pre-alpha — Work in progress. APIs may change. Not ready for production use.
+      <span aria-hidden="true">⚠️</span> Pre-alpha — Work in progress. APIs may change without notice. Not ready for production use.
     </div>
     <slot />
     <footer>