4 Commits

Author	SHA1	Message	Date
jwright	83edaf5975	M5: publish seam + CI/CD pipeline ... scripts/new-post.mjs writes schema-valid posts from flags or a JSON event (the IaC publish seam). Gitea Actions workflow: ci check, audit-ci gate, build, dist scan, CycloneDX SBOM, buildah build+push, and a least-privilege digest-bump PR to home-ops (never auto-merged). Renovate + audit allowlist.	2026-06-17 17:20:54 +10:00
jwright	c1db5cec86	M4: security pass — strict CSP, header split, build-time scan ... All JS moved to external /site.js → script-src 'self' with no inline JS, hashes or eval. Full header set via nginx (CSP, nosniff, frame-deny, referrer, permissions, COOP/CORP); HSTS stays at the CF edge. Shared headers include avoids the location add_header reset footgun. Build-time secret/inline-script/third-party scan gate. SECURITY.md documents posture.	2026-06-17 17:12:57 +10:00
jwright	22f482d89a	M2: content collections — case studies, blog, RSS, tags, sitemap ... Projects + blog as schema-validated content collections; structured case studies (problem/design/outcome), blog with tag pages, reading time, RSS feed (drafts excluded), sitemap, and Shiki dual-theme code highlighting.	2026-06-17 16:56:46 +10:00
jwright	2d4b6ea097	Initial portfolio site: Astro + Tailwind MVP ... Outcome-led hero, about, grouped skills, experience summary, featured projects + /projects index, static contact, SEO/OG, dark/light theme. Dockerfile + nginx config + build script for homelab deploy.	2026-06-17 16:22:53 +10:00