ci(demo-deploy): tighten permissions and add concurrency control #3

	name: Deploy Demo

	on:
	push:
	tags:
	- 'v*'

	permissions:
	contents: read
	pages: write
	id-token: write

	concurrency:
	group: pages
	cancel-in-progress: true

	jobs:
	build:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v5

	- name: Validate versions match
	run: \|
	TAG_VERSION="${GITHUB_REF#refs/tags/v}"
	ROOT_VERSION=$(node -p "require('./package.json').version")
	DEMO_VERSION=$(node -p "require('./demo/package.json').version")
	if [ "$TAG_VERSION" != "$ROOT_VERSION" ]; then
	echo "::error::Tag version ($TAG_VERSION) does not match root package.json ($ROOT_VERSION)"
	exit 1
	fi
	if [ "$TAG_VERSION" != "$DEMO_VERSION" ]; then
	echo "::error::Tag version ($TAG_VERSION) does not match demo package.json ($DEMO_VERSION)"
	exit 1
	fi
	echo "All versions match: $TAG_VERSION"

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: 24
	cache: npm

	- name: Install root dependencies
	run: npm ci

	- name: Install demo dependencies
	working-directory: demo
	run: npm ci

	- name: Build demo
	run: npm run demo:build

	- name: Upload Pages artifact
	uses: actions/upload-pages-artifact@v3
	with:
	path: demo/dist

	deploy:
	needs: build
	runs-on: ubuntu-latest
	environment:
	name: github-pages
	url: ${{ steps.deployment.outputs.page_url }}
	steps:
	- name: Deploy to GitHub Pages
	id: deployment
	uses: actions/deploy-pages@v4

Provide feedback