From 50993bedecd700b74c9da5298ee8e9625af32a5a Mon Sep 17 00:00:00 2001 From: jwright Date: Mon, 17 Aug 2026 19:51:12 +1000 Subject: [PATCH] pre-review hardening: technical qualifiers across all courses, git/Argo CD proper nouns, a11y (skip link, main, focus-visible, reduced-motion net, textContent legends), perf (intrinsic image dims, decoding async, lazy scenes + will-change lifecycle), nginx ^~ /assets/ priority, OG/canonical/build-revision, preflight gates --- Dockerfile | 2 + assets/dist/delivery-flow.svg | 4 +- nginx/default.conf | 9 +- pilot/arc.tpl.html | 448 ++++++++++++++++++---------------- pilot/assemble-arc.mjs | 114 ++++++++- pilot/manifest-gitops.json | 4 +- pilot/manifest-node.json | 2 +- pilot/manifest-pod.json | 4 +- pilot/manifest-supply.json | 4 +- 9 files changed, 358 insertions(+), 233 deletions(-) diff --git a/Dockerfile b/Dockerfile index 4455c65..e84b0b1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,6 +7,8 @@ # verified and cached in the zot pull-through mirror, so this layer costs nothing # extra. Only bash/sed/find/install are used here — node itself is incidental. FROM node:22-bookworm-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS build +ARG BUILD_REV=dev +ENV BUILD_REV=$BUILD_REV WORKDIR /app COPY . . RUN bash build.sh diff --git a/assets/dist/delivery-flow.svg b/assets/dist/delivery-flow.svg index 26906ff..358cf02 100644 --- a/assets/dist/delivery-flow.svg +++ b/assets/dist/delivery-flow.svg @@ -1,4 +1,4 @@ - + @@ -32,7 +32,7 @@ GitHub repo - ArgoCD: render + diff + sync + Argo CD: render + diff + sync diff --git a/nginx/default.conf b/nginx/default.conf index 179f0b3..7c44933 100644 --- a/nginx/default.conf +++ b/nginx/default.conf @@ -18,14 +18,17 @@ server { include /etc/nginx/security-headers.conf; # ---- Caching ------------------------------------------------------------- - # Scene images are content-hashed at build time → safe to cache hard. - location /assets/ { + # Everything under /assets/ is content-fingerprinted at build time -> cache hard. + # `^~` gives this prefix priority over the regex `.js` location below, so fingerprinted + # JavaScript gets the immutable policy rather than no-cache. + location ^~ /assets/ { include /etc/nginx/security-headers.conf; expires 1y; add_header Cache-Control "public, immutable" always; } - # Scripts are NOT fingerprinted yet — revalidate so a deploy actually propagates. + # Any JS OUTSIDE /assets/ (there is none today) revalidates; fingerprinted app JS is + # handled immutably by the ^~ /assets/ block above. location ~* \.js$ { include /etc/nginx/security-headers.conf; add_header Cache-Control "no-cache" always; diff --git a/pilot/arc.tpl.html b/pilot/arc.tpl.html index 20519eb..c5cf0e4 100644 --- a/pilot/arc.tpl.html +++ b/pilot/arc.tpl.html @@ -7,10 +7,10 @@ -