Parent: #1400 · Labels: enhancement, area/ci (auto, .github/**) · Size: M · Depends on: GP4 (the generator), GP3 (read-only bucket access)

Goal. Establish the repo's first GitHub Pages pipeline: a merge-to-main-cadence CI job that runs the GP4 generator against the GCS bucket and publishes the static site via upload-pages-artifact + deploy-pages.

Scope.

• New .github/workflows/evidence-dashboard-publish.yaml: on merge-to-main (and workflow_dispatch), authenticate to GCS read-only (GP3 read SA via the existing federation), run the GP4 generator to produce the site + JSON (index.json + series/*.json), then actions/configure-pages → actions/upload-pages-artifact → actions/deploy-pages, with permissions: pages: write, id-token: write (the first Pages workflow in the repo — a repo-wide grep for upload-pages-artifact/deploy-pages/pages: write returns nothing today; Fern publishes to docs.nvidia.com via publish-fern-docs.yml, a separate surface).
• Because the generator is byte-deterministic, the job can run as a straightforward publish (no drift-PR needed for the site); a determinism check can be wired so a non-reproducible build fails loudly.
• Pin all action SHAs (repo norm, e.g. uat-gcp.yaml:109,:115); bounded timeout-minutes; runs-on: ubuntu-latest.
• Establish the Pages environment; a custom domain is deferred (see Deferred).

Out of scope. The generator/model (GP4); the ingest (GP2); the bucket/SA (GP3); the docs page (GP6). A custom domain.

Key files. New .github/workflows/evidence-dashboard-publish.yaml; the GP4 generator (invoked); GCS read auth uat-gcp.yaml:53-54,:109,:115; HTML-artifact precedent demos/*.html. (No existing Pages workflow to model on — this child establishes the pattern.)

Tests. Workflow-syntax lint (repo actions-lint path); an assertion the workflow declares permissions: pages: write + id-token: write and uses the read-only GCS identity (not the GP2 write SA, not the shared SA); a dry-run/fixture build asserting the generator output uploads as a Pages artifact; a determinism gate (two builds → identical artifact) wired into the job. Fork-safety: no GCS credentials exposed to PR/fork context.

Acceptance. A merge-to-main run regenerates the site from the GCS bucket and deploys it to GitHub Pages via upload-pages-artifact + deploy-pages with pages: write; the Pages site is live and reachable at a stable per-recipe coordinate URL; the publish identity is read-only on GCS; the build is reproducible.

Child of #1400 · staged from docs/design/013-interim-evidence-dashboard.md (GP5).