rudolfjs.github.io

Rudolf J profile hosted using GitHub Pages at https://rudolfjs.id.au.

Maintenance mode

The site is currently a single "down for maintenance" holding page built with Astro and TypeScript, while the full site is rebuilt on Astro. The page is rendered as both / and /404.html, so every old URL lands on it.

The previous Hugo site (content, theme, Typst renders, presentations) was removed from main. It is preserved at the v3.5.0 tag:

git checkout v3.5.0 -- content/   # e.g. to bring the Markdown content back

Layout

Path	Purpose
src/components/HoldingPage.astro	The holding page (markup + inlined CSS)
src/data/profile.ts	Profile links shown on the page
src/pages/index.astro, src/pages/404.astro	Routes; both render the holding page
public/	Static files copied as-is (favicon)
tests/site.test.ts	Contract tests for dist/ and the workflows (node:test)
.husky/pre-push	Local CVE checks + verify before every push
.github/workflows/site.yml	CI/CD: CVE scan, build, test, deploy to Pages
.github/workflows/osv-scanner.yml	OSV-Scanner: code scanning alerts and PR checks

Development

Requires Node.js 22.18+ (the tests use Node's built-in TypeScript type stripping). CI uses the version in .nvmrc.

npm install        # also installs the Husky git hooks
npm run dev        # http://localhost:4321
npm run verify     # astro check + build + tests
npm run preview    # serve dist/

Security checks

npm run security runs:

1. npm audit --audit-level=low (GitHub Advisory Database, the same data Dependabot uses)
2. npm audit signatures (registry signatures and provenance)
3. osv-scanner against package-lock.json, if it is installed locally (install); set OSV_REQUIRED=1 to make it mandatory

The Husky pre-push hook runs npm run security and then npm run verify, so a push with a known CVE in the lockfile, a type error or a failing test is refused. Bypass in an emergency with git push --no-verify.

CI/CD

.github/workflows/site.yml:

Trigger	CVE scan	Check, build, test	Deploy
Pull request	✓	✓
Push to main / manual run on main	✓	✓	✓
Weekly (Mon 03:17 UTC)	✓	✓

The deploy job needs both the CVE scan and the build to pass.

.github/workflows/osv-scanner.yml runs Google's OSV-Scanner reusable workflows against osv.dev and uploads the results to Security > Code scanning:

Trigger	Scan	Fails on
Pull request to main	PR and base branch, compared	Vulnerabilities the PR introduces
Push to main, daily (04:41 UTC), manual run	Full	Any known vulnerability

All actions and reusable workflows are pinned to full commit SHAs, and jobs get only the permissions they need. Dependabot (.github/dependabot.yml) proposes grouped weekly updates for npm and GitHub Actions after a 7-day cooldown; security updates are not delayed.

Changelog

Changes are recorded with Changie:

changie new        # add a fragment under .changes/unreleased/
changie batch auto && changie merge