chore(ci): add dnslink-action, cluster, and GitHub Pages

- add DNSLink update via ipshipyard/dnslink-action@v1
- add IPFS cluster deployment with 90-day expiry for non-main branches
- add GitHub Pages as HTTPS fallback
- Fleek hosting shuts down Jan 31, 2026

Related: https://github.com/ipshipyard/waterworks-community/issues/23

.github/workflows/deploy.yml

@@ -8,6 +8,7 @@ name: Deploy
 
 # Explicitly declare permissions
 permissions:
+  actions: read
   contents: read
   pull-requests: write
   statuses: write
@@ -26,6 +27,8 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       cid: ${{ steps.deploy.outputs.cid }}
+    environment:
+      name: 'ipfs-publish'
     steps:
       - name: Download build artifact
         uses: actions/download-artifact@v4
@@ -40,6 +43,57 @@ jobs:
         id: deploy
         with:
           path-to-deploy: ${{ env.BUILD_PATH }}
+          cluster-url: "/dnsaddr/ipfs-websites.collab.ipfscluster.io"
+          cluster-user: ${{ secrets.CLUSTER_USER }}
+          cluster-password: ${{ secrets.CLUSTER_PASSWORD }}
+          cluster-pin-expire-in: ${{ github.event.workflow_run.head_branch != 'main' && '2160h' || '' }}
           storacha-key: ${{ secrets.STORACHA_KEY }}
           storacha-proof: ${{ secrets.STORACHA_PROOF }}
           github-token: ${{ github.token }}
+
+  dnslink-update:
+    runs-on: ubuntu-latest
+    needs: deploy-ipfs
+    if: github.event.workflow_run.head_branch == 'main'
+    environment:
+      name: 'cf-dnslink'
+      url: "https://blog-ipfs-tech.ipns.inbrowser.link/"
+    steps:
+      - name: Update DNSLink
+        uses: ipshipyard/dnslink-action@v1
+        with:
+          cid: ${{ needs.deploy-ipfs.outputs.cid }}
+          dnslink_domain: 'blog-ipfs-tech.dnslinks.ipshipyard.tech'
+          cf_zone_id: ${{ secrets.CF_DNS_ZONE_ID }}
+          cf_auth_token: ${{ secrets.CF_DNS_AUTH_TOKEN }}
+          github_token: ${{ github.token }}
+          set_github_status: true
+
+  deploy-gh-pages:
+    if: |
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_branch == 'main'
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Download build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: blog-build-${{ github.event.workflow_run.id }}
+          path: blog-build
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: blog-build
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4