adam/seahaven-site
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-site.git synced 2026-10-01 23:03:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
seahaven-site/package.json

21 lines
456 B
JSON
Raw Normal View History

Migrate to thin Eleventy build + a11y/SEO/perf/CI hardening (#20) * chore(build): add Eleventy scaffold Thin Eleventy build (v3.1.6, pinned) — passthrough-copies assets/, robots.txt, sitemap.xml; outputs flat HTML to _site/. _data/site.json holds site-wide constants; _data/images.json maps image keys to src+width+height for the {% image %} shortcode (CLS fix). Output stays flat HTML served from the same S3 bucket + CloudFront. * refactor(templates): base layout, partials, shared JS, CSS extraction - _includes/base.njk + nav/mobile-menu/footer partials reproduce the shared chrome once (was hand-duplicated across 13 pages). Adds a skip-link and <main> landmark (WCAG 2.4.1), aria-expanded/role=dialog hooks on the menu, and a {% year %} shortcode replacing document.write. - assets/js/nav.js: extracted sticky-nav + accessible mobile-menu dialog (focus trap, Escape, focus return) + rAF-throttled hero parallax. - assets/js/form.js: Basin AJAX submit with an accessible status region. - assets/css/*.css: per-page inline <style> extracted into page CSS files (home/about/services/careers/jobs/contact/social/legal/404); skip-link + :focus-visible added to main.css. - index.njk: homepage converted as the reference page. * fix(css): make hero-bg url root-relative after extraction Inline CSS used a document-relative url('assets/...') that resolves correctly from / but breaks once moved into /assets/css/home.css. Rewrite to /assets/images/. * refactor(pages): convert 12 pages to Eleventy templates Convert about, services, careers (listing + 3 jobs), contact, social- accountability, privacy-policy, terms-of-service, eula, and 404 from standalone HTML to .njk against base.njk. Each page now carries only front-matter (title/description/SEO) + its <main> content; shared head/ nav/footer/scripts come from the layout. JobPosting + LocalBusiness JSON-LD preserved. Images use the {% image %} shortcode (width/height). Contact gets an accessible #form-status region. form.js generalized to wire BOTH the contact form and the .apply-form job application forms (was contact-only), preserving each submit button's own label. * fix(a11y): footer contrast to WCAG AA + scope services .form-group Raise footer text colors (footer-bottom/col/brand/social/contact) and darken --text-muted so muted text clears 4.5:1 on the dark footer and warm-gray surfaces. Scope services' flex .form-group override to .contact-form .form-group so it can't leak to the global rule. * perf(seo): og-cover image, webp logos, hero preload Add a real 1200x630 og-cover.jpg (was a 153x49 favicon) wired site-wide via base.njk og:image/twitter:image. Convert nav/footer logos to webp (nav 58KB->22KB); PNGs kept as passthrough so old URLs still resolve. Preload the LCP hero image on the homepage (fetchpriority=high). All <img> carry width/height via the image shortcode (CLS). * ci(deploy): build-then-sync, cache headers, safe concurrency Rename main.yml -> deploy.yaml (org convention). Build with Eleventy (npm ci && npm run build) and sync _site/ instead of the repo root, so only built output ships (no source/templates/node_modules). Split Cache-Control (1-day assets, no-cache HTML) and keep /* invalidation since filenames are not yet fingerprinted. concurrency cancel-in-progress false so a deploy is never cut mid sync. ci.yaml validates _site/ via ci-static build mode. * docs: README for the Eleventy build and structure * fix(security): wire services form, guard build, harden deploy Fable build-review findings: - BLOCK: services puts .contact-form on the <form> itself (contact uses a wrapper div), so form.js selector '.contact-form form' never matched it — the services lead form submitted natively with an empty reCAPTCHA token. Selector now also matches form.contact-form. - Guard the build before the --delete S3 sync: require index/contact/404 and >=40 files, so a silently-empty build can never wipe the live bucket. - npm ci --ignore-scripts on deploy (build verified to pass) to shrink the supply-chain window on the OIDC-credentialed runner. - Escape quotes in the image shortcode alt text.
2026-06-12 17:02:06 -04:00
{
"name": "seahaven-site",
"version": "1.0.0",
"private": true,
"description": "Sea Haven Industries marketing site — static HTML built with Eleventy, served from S3 + CloudFront.",
"scripts": {
"build": "eleventy",
"serve": "eleventy --serve",
"clean": "rm -rf _site"
},
"license": "UNLICENSED",
"dependencies": {
"@11ty/eleventy": "3.1.6"
INFRA-143: suppress reCAPTCHA site-key gitleaks FP + clear js-yaml DoS advisory (#27) * chore(security): suppress gitleaks FP on public reCAPTCHA site key (INFRA-143) The SITE_KEY in assets/js/form.js is a Google reCAPTCHA v3 site key, public by design (shipped to the browser, passed to grecaptcha.execute). It is not a secret and is not rotated. Add a scoped repo-local gitleaks suppression with justification for the current (line 7) and historical (line 5) hits so the pre-push scanner stops blocking on it. * fix(deps): pin gray-matter js-yaml to 3.15.0 to clear DoS advisory (INFRA-143) gray-matter (transitive via @11ty/eleventy) pulled js-yaml 3.14.2, flagged by GHSA-h67p-54hq-rp68 (quadratic-complexity DoS in merge-key handling, moderate). Add a scoped nested npm override pinning gray-matter's js-yaml to ^3.15.0, the fixed 3.x release, leaving Eleventy's direct js-yaml 4.x untouched. npm audit now reports 0 vulnerabilities and the Eleventy build passes.
2026-07-08 16:21:21 -04:00
},
"overrides": {
"gray-matter": {
chore(deps): update dependency js-yaml to ^4.3.2
2026-08-31 06:42:42 +00:00
"js-yaml": "^4.3.2"
INFRA-143: suppress reCAPTCHA site-key gitleaks FP + clear js-yaml DoS advisory (#27) * chore(security): suppress gitleaks FP on public reCAPTCHA site key (INFRA-143) The SITE_KEY in assets/js/form.js is a Google reCAPTCHA v3 site key, public by design (shipped to the browser, passed to grecaptcha.execute). It is not a secret and is not rotated. Add a scoped repo-local gitleaks suppression with justification for the current (line 7) and historical (line 5) hits so the pre-push scanner stops blocking on it. * fix(deps): pin gray-matter js-yaml to 3.15.0 to clear DoS advisory (INFRA-143) gray-matter (transitive via @11ty/eleventy) pulled js-yaml 3.14.2, flagged by GHSA-h67p-54hq-rp68 (quadratic-complexity DoS in merge-key handling, moderate). Add a scoped nested npm override pinning gray-matter's js-yaml to ^3.15.0, the fixed 3.x release, leaving Eleventy's direct js-yaml 4.x untouched. npm audit now reports 0 vulnerabilities and the Eleventy build passes.
2026-07-08 16:21:21 -04:00
}
Migrate to thin Eleventy build + a11y/SEO/perf/CI hardening (#20) * chore(build): add Eleventy scaffold Thin Eleventy build (v3.1.6, pinned) — passthrough-copies assets/, robots.txt, sitemap.xml; outputs flat HTML to _site/. _data/site.json holds site-wide constants; _data/images.json maps image keys to src+width+height for the {% image %} shortcode (CLS fix). Output stays flat HTML served from the same S3 bucket + CloudFront. * refactor(templates): base layout, partials, shared JS, CSS extraction - _includes/base.njk + nav/mobile-menu/footer partials reproduce the shared chrome once (was hand-duplicated across 13 pages). Adds a skip-link and <main> landmark (WCAG 2.4.1), aria-expanded/role=dialog hooks on the menu, and a {% year %} shortcode replacing document.write. - assets/js/nav.js: extracted sticky-nav + accessible mobile-menu dialog (focus trap, Escape, focus return) + rAF-throttled hero parallax. - assets/js/form.js: Basin AJAX submit with an accessible status region. - assets/css/*.css: per-page inline <style> extracted into page CSS files (home/about/services/careers/jobs/contact/social/legal/404); skip-link + :focus-visible added to main.css. - index.njk: homepage converted as the reference page. * fix(css): make hero-bg url root-relative after extraction Inline CSS used a document-relative url('assets/...') that resolves correctly from / but breaks once moved into /assets/css/home.css. Rewrite to /assets/images/. * refactor(pages): convert 12 pages to Eleventy templates Convert about, services, careers (listing + 3 jobs), contact, social- accountability, privacy-policy, terms-of-service, eula, and 404 from standalone HTML to .njk against base.njk. Each page now carries only front-matter (title/description/SEO) + its <main> content; shared head/ nav/footer/scripts come from the layout. JobPosting + LocalBusiness JSON-LD preserved. Images use the {% image %} shortcode (width/height). Contact gets an accessible #form-status region. form.js generalized to wire BOTH the contact form and the .apply-form job application forms (was contact-only), preserving each submit button's own label. * fix(a11y): footer contrast to WCAG AA + scope services .form-group Raise footer text colors (footer-bottom/col/brand/social/contact) and darken --text-muted so muted text clears 4.5:1 on the dark footer and warm-gray surfaces. Scope services' flex .form-group override to .contact-form .form-group so it can't leak to the global rule. * perf(seo): og-cover image, webp logos, hero preload Add a real 1200x630 og-cover.jpg (was a 153x49 favicon) wired site-wide via base.njk og:image/twitter:image. Convert nav/footer logos to webp (nav 58KB->22KB); PNGs kept as passthrough so old URLs still resolve. Preload the LCP hero image on the homepage (fetchpriority=high). All <img> carry width/height via the image shortcode (CLS). * ci(deploy): build-then-sync, cache headers, safe concurrency Rename main.yml -> deploy.yaml (org convention). Build with Eleventy (npm ci && npm run build) and sync _site/ instead of the repo root, so only built output ships (no source/templates/node_modules). Split Cache-Control (1-day assets, no-cache HTML) and keep /* invalidation since filenames are not yet fingerprinted. concurrency cancel-in-progress false so a deploy is never cut mid sync. ci.yaml validates _site/ via ci-static build mode. * docs: README for the Eleventy build and structure * fix(security): wire services form, guard build, harden deploy Fable build-review findings: - BLOCK: services puts .contact-form on the <form> itself (contact uses a wrapper div), so form.js selector '.contact-form form' never matched it — the services lead form submitted natively with an empty reCAPTCHA token. Selector now also matches form.contact-form. - Guard the build before the --delete S3 sync: require index/contact/404 and >=40 files, so a silently-empty build can never wipe the live bucket. - npm ci --ignore-scripts on deploy (build verified to pass) to shrink the supply-chain window on the OIDC-credentialed runner. - Escape quotes in the image shortcode alt text.
2026-06-12 17:02:06 -04:00
}
}
Reference in a new issue Copy permalink