2026-05-12 01:57:55 -05:00
|
|
|
# Dependencies
|
|
|
|
|
node_modules
|
|
|
|
|
npm-debug.log*
|
|
|
|
|
yarn-debug.log*
|
|
|
|
|
yarn-error.log*
|
|
|
|
|
pnpm-debug.log*
|
|
|
|
|
lerna-debug.log*
|
|
|
|
|
|
|
|
|
|
# Build output
|
|
|
|
|
dist
|
|
|
|
|
build
|
|
|
|
|
*.tsbuildinfo
|
|
|
|
|
|
|
|
|
|
# Database runtime files
|
|
|
|
|
db
|
|
|
|
|
*.db
|
|
|
|
|
*.sqlite
|
|
|
|
|
*.sqlite3
|
|
|
|
|
|
|
|
|
|
# Git
|
|
|
|
|
.git
|
|
|
|
|
.gitignore
|
|
|
|
|
.gitattributes
|
|
|
|
|
|
|
|
|
|
# Logs
|
|
|
|
|
logs
|
|
|
|
|
*.log
|
|
|
|
|
|
fix(seo): the production sitemap had no dates, and the build context had secrets
Three things, all in the path between this repository and the running image.
Closes #225, #224 and #223.
1. THE PRODUCTION SITEMAP CARRIED NO LASTMOD AT ALL. Dates come from git
history, and the image build cannot see git: .dockerignore excludes .git and
node:alpine has no git binary. prerender.js read the failure into an empty
catch commented "git unavailable or file untracked", so all 18 URLs came out
undated while the build printed a success line. Local builds looked perfect,
which is why nobody caught it.
release.sh now computes the map where git exists, passes it as the
SITEMAP_LASTMOD build arg, and then asks the built image whether its sitemap
has dates, refusing to publish one that does not. prerender prints the count
on every run, so "18 URLs, 0 dated" can never again read as success. The
route-to-source map moved into scripts/lib/routes.js, where a service page
now also counts its own content file, so editing one page's copy moves that
page's date and no other.
Proven: an image built with the arg carries 18 lastmod entries; a build with
git deliberately unreadable and no arg reports "18 URLs, 0 carrying a
lastmod" and warns.
2. THE DOCKER BUILD CONTEXT CARRIED CLIENT MATERIAL AND LIVE SECRETS. .drop/,
zoho.md (the reCAPTCHA secret and the Zoho tokens), Levi.md and two 30 MB
zips were all sent to the daemon on every build, along with four agent
workspaces. The final image copies only built output, so none of it ever
shipped, but one careless COPY would have changed that. Proven by listing the
context from inside a throwaway image: before, all of it; after, none of it.
3. UNTRACKED FILES PASSED SILENTLY. docker build packs the working tree, so an
untracked module the code imports produces an image that works and a tag that
cannot rebuild it. release.sh now refuses while untracked files are present,
and pre-commit's note counts them too.
#223 also claimed post-commit hides a refused push. It does not: it printed
"push was refused. The commit is safe locally and the branch is now ahead."
during this batch. The issue was corrected on the tracker rather than acted on.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-10 04:58:37 -05:00
|
|
|
# Client material and operator credentials. None of it belongs in the build
|
|
|
|
|
# context, which is sent to the Docker daemon in full: .drop/ holds the original
|
|
|
|
|
# site drop and the owner's copy sheets, zoho.md holds the live reCAPTCHA secret
|
|
|
|
|
# and the Zoho tokens, and the zips are 30 MB each. The final image copies only
|
|
|
|
|
# built output, so none of this has ever shipped, but one careless COPY would
|
|
|
|
|
# change that, and every build sends it across for no reason.
|
|
|
|
|
.drop
|
|
|
|
|
zoho.md
|
|
|
|
|
Levi.md
|
|
|
|
|
*.zip
|
|
|
|
|
*.eml
|
|
|
|
|
*.pdf
|
|
|
|
|
|
|
|
|
|
# Agent workspaces and local editor state. Gitignored, and no more use to a
|
|
|
|
|
# build than they are to the image.
|
|
|
|
|
.claude
|
|
|
|
|
.codex
|
|
|
|
|
.agents
|
|
|
|
|
.learnings
|
|
|
|
|
*.code-workspace
|
|
|
|
|
|
2026-05-12 01:57:55 -05:00
|
|
|
# Private docs (ignored per requirements)
|
|
|
|
|
DEVELOPMENT_LOG.md
|
|
|
|
|
FUTURE.md
|
|
|
|
|
HISTORY.md
|
|
|
|
|
BUILD_SUMMARY.md
|
|
|
|
|
PROJECT.md
|
|
|
|
|
SCRIPTS.md
|
|
|
|
|
STRUCTURE.md
|
|
|
|
|
OVERHAUL_PLAN.md
|
|
|
|
|
MEMORY.md
|
|
|
|
|
AGENTS.md
|
|
|
|
|
SOUL.md
|
|
|
|
|
IDENTITY.md
|
|
|
|
|
USER.md
|
|
|
|
|
TOOLS.md
|
|
|
|
|
|
|
|
|
|
# IDE
|
|
|
|
|
.idea
|
|
|
|
|
.vscode
|
|
|
|
|
*.swp
|
|
|
|
|
*.swo
|
|
|
|
|
*~
|
|
|
|
|
|
|
|
|
|
# OS
|
|
|
|
|
.DS_Store
|
|
|
|
|
Thumbs.db
|
|
|
|
|
|
|
|
|
|
# Docker files (not needed in image)
|
|
|
|
|
Dockerfile
|
|
|
|
|
docker-compose.yml
|
|
|
|
|
.dockerignore
|
|
|
|
|
|
|
|
|
|
# Runtime data
|
|
|
|
|
*.pid
|
|
|
|
|
*.seed
|
|
|
|
|
coverage/
|
|
|
|
|
|
|
|
|
|
# Environment files (don't include in image)
|
|
|
|
|
.env
|
|
|
|
|
.env.local
|
|
|
|
|
.env.production
|
|
|
|
|
|
|
|
|
|
# Docker socket mount (not needed in image)
|
|
|
|
|
/var/run/docker.sock
|
|
|
|
|
|
|
|
|
|
# Host volume permissions
|
|
|
|
|
# Ensure ./db and ./logs are writable by UID 1001 before running
|
|
|
|
|
# Run: sudo chown -R 1001:1001 ./db ./logs
|