From 51d1ccb149706b387ffa9def8a14e8d0ceb7e24f Mon Sep 17 00:00:00 2001 From: Jonathon Wright Date: Tue, 18 Aug 2026 02:03:57 +1000 Subject: [PATCH] README: describe the JS that actually ships instead of claiming zero, and note why the site still works with JS disabled --- README.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index f3186bd..4621838 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,10 @@ by default. ## Stack - Astro (static output), TypeScript, Tailwind v4 -- Zero JS by default; small islands for the theme toggle and scroll reveals +- Static output with one self-hosted client bundle (~74 KB: Motion for scroll reveals, plus a + small pre-paint theme script). No inline script anywhere, so `script-src 'self'` holds. +- Content is visible with JavaScript disabled: reveal styles are gated behind an `html.js` + class the script adds, and `prefers-reduced-motion` forces the visible state - Content and config are data-driven (`src/data/`, `src/content/`) - adding a post or project never touches a component @@ -62,7 +65,7 @@ SBOM (CycloneDX) -> buildah build+push -> open a digest-bump PR to home-ops ``` The PR is never auto-merged - the deploy repo's `main` is branch-protected, and -merging the PR is what triggers the ArgoCD rollout. The runner holds +merging the PR is what triggers the Argo CD rollout. The runner holds least-privilege credentials only: a scoped deploy key, a PR token, and a registry push token. @@ -75,5 +78,5 @@ registry push token. Built into a container image, served by nginx-unprivileged on Kubernetes, exposed outbound-only via Cloudflare Tunnel. The image is pinned by digest in -the private deploy repo and rolled out by ArgoCD. Manual bootstrap build: +the private deploy repo and rolled out by Argo CD. Manual bootstrap build: `scripts/build-image.sh push`. Full posture in `SECURITY.md`.