jwright/bztmon-site
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

README: describe the JS that actually ships instead of claiming zero, and note why the site still works with JS disabled

Browse Source
This commit is contained in:
Jonathon Wright
2026-08-18 02:03:57 +10:00
parent 36444c3424
commit 51d1ccb149
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+6 -3
View File
@@ -11,7 +11,10 @@ by default.
## Stack ## Stack
- Astro (static output), TypeScript, Tailwind v4 - Astro (static output), TypeScript, Tailwind v4
- Zero JS by default; small islands for the theme toggle and scroll reveals - Static output with one self-hosted client bundle (~74 KB: Motion for scroll reveals, plus a
small pre-paint theme script). No inline script anywhere, so `script-src 'self'` holds.
- Content is visible with JavaScript disabled: reveal styles are gated behind an `html.js`
class the script adds, and `prefers-reduced-motion` forces the visible state
- Content and config are data-driven (`src/data/`, `src/content/`) - adding a - Content and config are data-driven (`src/data/`, `src/content/`) - adding a
post or project never touches a component post or project never touches a component
@@ -62,7 +65,7 @@ SBOM (CycloneDX) -> buildah build+push -> open a digest-bump PR to home-ops
``` ```
The PR is never auto-merged - the deploy repo's `main` is branch-protected, and The PR is never auto-merged - the deploy repo's `main` is branch-protected, and
merging the PR is what triggers the ArgoCD rollout. The runner holds merging the PR is what triggers the Argo CD rollout. The runner holds
least-privilege credentials only: a scoped deploy key, a PR token, and a least-privilege credentials only: a scoped deploy key, a PR token, and a
registry push token. registry push token.
@@ -75,5 +78,5 @@ registry push token.
Built into a container image, served by nginx-unprivileged on Kubernetes, Built into a container image, served by nginx-unprivileged on Kubernetes,
exposed outbound-only via Cloudflare Tunnel. The image is pinned by digest in exposed outbound-only via Cloudflare Tunnel. The image is pinned by digest in
the private deploy repo and rolled out by ArgoCD. Manual bootstrap build: the private deploy repo and rolled out by Argo CD. Manual bootstrap build:
`scripts/build-image.sh push`. Full posture in `SECURITY.md`. `scripts/build-image.sh push`. Full posture in `SECURITY.md`.