pre-review hardening: technical qualifiers across all courses, git/Argo CD proper nouns, a11y (skip link, main, focus-visible, reduced-motion net, textContent legends), perf (intrinsic image dims, decoding async, lazy scenes + will-change lifecycle), nginx ^~ /assets/ priority, OG/canonical/build-revision, preflight gates

2026-08-17 19:51:12 +10:00
parent b41564d462
commit 50993bedec
9 changed files with 358 additions and 233 deletions
@@ -1,4 +1,4 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1180" height="660" viewBox="0 0 1180 660" role="img" aria-label="End-to-end delivery flow in four lanes converging on one running workload. Change lane: a commit lands in the GitHub repository, ArgoCD renders and diffs it against the live cluster and syncs the difference - the cluster pulls, nothing pushes. Shape lane: the Helm chart plus a per-cluster values context passes the schema gate, which refuses to render if a required value is missing, and produces the manifests ArgoCD applies. Artefact lane: CI builds once and pushes to Azure Container Registry; a central pull-through mirror in the cloud fronts upstream, per-site mirrors pull from the centre, and each node pulls by digest - the load fans out in tiers so no thundering herd ever reaches upstream. Secret lane: Azure Key Vault holds the values, the External Secrets operator syncs them into the cluster, and git only ever holds the reference. The workload that runs is the sum of all four: synced state, rendered shape, digest-pinned image, injected secret.">
+<svg xmlns="http://www.w3.org/2000/svg" width="1180" height="660" viewBox="0 0 1180 660" role="img" aria-label="End-to-end delivery flow in four lanes converging on one running workload. Change lane: a commit lands in the GitHub repository, Argo CD renders and diffs it against the live cluster and syncs the difference - the cluster pulls, nothing pushes. Shape lane: the Helm chart plus a per-cluster values context passes the schema gate, which refuses to render if a required value is missing, and produces the manifests Argo CD applies. Artefact lane: CI builds once and pushes to Azure Container Registry; a central pull-through mirror in the cloud fronts upstream, per-site mirrors pull from the centre, and each node pulls by digest - the load fans out in tiers so no thundering herd ever reaches upstream. Secret lane: Azure Key Vault holds the values, the External Secrets operator syncs them into the cluster, and git only ever holds the reference. The workload that runs is the sum of all four: synced state, rendered shape, digest-pinned image, injected secret.">
  <defs>
    <marker id="arr" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
      <path d="M 0 0 L 10 5 L 0 10 z" fill="#64748b"></path>
@@ -32,7 +32,7 @@
    <rect x="270" y="136" width="180" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
    <text x="360" y="165" text-anchor="middle">GitHub repo</text>
    <rect x="510" y="136" width="230" height="48" rx="10" fill="#0c8fce" fill-opacity="0.06" stroke="#0c8fce" stroke-width="2"></rect>
-    <text x="625" y="165" text-anchor="middle" fill="#0c8fce">ArgoCD: render + diff + sync</text>
+    <text x="625" y="165" text-anchor="middle" fill="#0c8fce">Argo CD: render + diff + sync</text>
  </g>
  <g stroke="#64748b" stroke-width="1.5" marker-end="url(#arr)">
    <line x1="210" y1="160" x2="264" y2="160"></line>