ci: Lighthouse CI budgets on PRs (closes #13)

A public single-page showcase site with no perf / a11y / SEO checks — oversized
images, broken meta/OG tags, contrast issues, or render-blocking assets could
ship silently.

- lighthouse.yml: on every PR, build the site and run Lighthouse CI over the
  static public/ (Hugo built with baseURL "/" so the root-relative, fully
  self-contained output serves locally). Reports stored as a GitHub artifact —
  no third-party upload, in keeping with the site's zero-third-party ethos.
- lighthouserc.json: category assertions for performance (0.90), accessibility
  (0.95), SEO (0.95), best-practices (0.95) — set to "warn" to start so the
  first runs record a baseline; ratchet to hard "error" floors once known.

Verified locally: production build is root-relative and self-contained
(LHCI-servable); prettier/JSON/YAML/zizmor clean. The Lighthouse job runs on
this PR, so its scores are the recorded baseline.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: VijitSingh97

.github/workflows/lighthouse.yml

@@ -0,0 +1,38 @@
+name: Lighthouse
+
+# Performance / accessibility / SEO / best-practices budgets on the built site, on every PR.
+# Assertions start as WARNINGS (non-blocking) so we can record a baseline; ratchet them to hard
+# 'error' floors in lighthouserc.json once the numbers are known (#13).
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lighthouse:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false # zizmor: artipacked
+      - name: Install Hugo (extended)
+        run: |
+          HUGO_VERSION="$(cat .hugoversion 2>/dev/null || echo 0.162.1)" # tracks .hugoversion once #15 lands
+          wget -O "${{ runner.temp }}/hugo.deb" \
+            "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb"
+          sudo dpkg -i "${{ runner.temp }}/hugo.deb"
+      - name: Build site
+        env:
+          HUGO_ENVIRONMENT: production
+          TZ: UTC
+        run: hugo --gc --minify --baseURL "/"
+      - name: Lighthouse CI
+        uses: treosh/lighthouse-ci-action@3e7e23fb74242897f95c0ba9cabad3d0227b9b18 # v12.6.2
+        with:
+          configPath: ./lighthouserc.json
+          uploadArtifacts: true # store HTML reports as a GitHub artifact (no third-party upload)
+          temporaryPublicStorage: false

lighthouserc.json

@@ -0,0 +1,17 @@
+{
+  "ci": {
+    "collect": {
+      "staticDistDir": "./public",
+      "numberOfRuns": 3
+    },
+    "assert": {
+      "//": "Warnings to start (#13): record a baseline from the first runs, then ratchet these to 'error' floors just under it so regressions fail.",
+      "assertions": {
+        "categories:performance": ["warn", { "minScore": 0.9 }],
+        "categories:accessibility": ["warn", { "minScore": 0.95 }],
+        "categories:seo": ["warn", { "minScore": 0.95 }],
+        "categories:best-practices": ["warn", { "minScore": 0.95 }]
+      }
+    }
+  }
+}