Repository navigation
SEO + growth funnel - #8
Open
miguelrisero wants to merge 8 commits into
Open
miguelrisero wants to merge 8 commits into
miguelrisero wants to merge 8 commits into
Conversation
Public-repo essentials: MIT LICENSE; SECURITY.md (private disclosure + no-secrets policy); CONTRIBUTING.md (how to add a template, slug rule, no-secrets, lockfile); CODEOWNERS gating build scripts/workflows/config; PR + issue templates with a secrets/build-command checklist.
Least-privilege `permissions: contents: read`, concurrency cancellation, and SHA-pinned actions (checkout v6.0.3, setup-node v6.4.0) so tag re-points can't change CI. Dependabot covers github-actions + npm (root and projects/*).
Validate project folder names against a strict slug (^[a-z0-9][a-z0-9-]*$) at discovery and skip the rest — closes the command-injection vector where a folder name was interpolated into `sh -c` (`npx vite build --base /<name>/`). Extend the static-copy filter to drop secret-looking files (.env*, .npmrc, *.pem/*.key, ssh keys) so a template can't publish credentials. HTML-escape project name/title/type and section titles in the generated landing index, and allowlist link schemes (internal paths + http(s) only) so externals.json can't inject script/markup.
- detectInstallCmd uses `npm ci` for package-lock projects (was `npm install`, which floats deps) — matches build-node-functions.mjs. - run() gains a child 'error' handler + double-settle guard so a failed spawn rejects instead of hanging the build forever. - Bounded build concurrency (mapLimit) instead of unbounded Promise.allSettled. - Assembly, landing index, and config now use only successfully-built projects, so a failed project can't leak partial/empty output into the deployment. - Extract pure buildVercelConfig() (fail-fast on multi-segment dynamic [param] entries that would silently 404), and export pure helpers + guard main() so the orchestrator can be unit-tested.
…ve path Refuse the 'local-dev-cron-secret' fallback when CI/VERCEL/NODE_ENV=production, and report the actual served directory (.vercel/output/static, dist fallback) instead of the stale 'Serving from: dist'.
node --test coverage for escapeHtml, safeHref, slug validation, and buildVercelConfig (static, dynamic [id], catchAll, multi-segment reject, nuxt-server ordering, crons) + collectCronEntries. Adds `npm test` and a CI test step — exercises the routing/cron logic that the example projects don't.
Now that the hub is indexable, make it discoverable and a real funnel: - Landing <head> gains meta description, canonical, Open Graph + Twitter cards, theme-color, and an SVG brand favicon. - Generate robots.txt (always) and sitemap.xml (when SITE_URL / Vercel prod URL is known) from the built project list. - Opt-in selective noindex: a template with `"noindex": true` gets a robots meta and is dropped from the sitemap (default stays indexable). - Header 'Build with Runflow' CTA + footer linking runflow.io (UTM-tagged) and the GitHub source, so the branded hub points back at the product. - Vercel Web Analytics script (no-op until enabled on the project).
Unit tests for buildSitemap (skips noindex) and buildRobotsTxt; README Deployment section documents SITE_URL, generated robots/sitemap, and the noindex opt-out.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
miguelrisero
force-pushed
the
fix/build-robustness-and-tests
branch
from
October 14, 2026 19:24
4431a72 to
ddf8521
Compare
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack 4 of 5 (base:
fix/build-robustness-and-tests). Council P2 — discoverability + funnel now that the hub is indexable.<head>: meta description, canonical, Open Graph + Twitter cards,theme-color, SVG brand favicon.robots.txt(always) +sitemap.xml(whenSITE_URLor Vercel's prod URL is set), generated from the built project list.noindexopt-in:"noindex": truein atemplate.config.jsonadds a robots meta + drops it from the sitemap. Default stays indexable — so this doesn't reverse the earlier "make it indexable" change, just makes it controllable per template.runflow.io(UTM-tagged) and the GitHub source — the branded hub now points back at the product.SITE_URL+ the noindex opt-out.npm test(13) +npm run buildgreen; sitemap/robots verified withSITE_URLset.