Put the site at the top level, where the deploy actually lands

Hostinger's Git deployment clones the whole repository into the document
root. "Root directory: public_html" is the destination on the server, not
a folder inside the repository. I read it the other way and spent several
rounds putting the site into a public_html/ folder here, which the deploy
then cloned to public_html/public_html/ -- one level too deep, no
index.html at the top, and a 403 every time. Both readings produce a 403,
which is why nothing distinguished them until a listing of the document
root showed .git, my-app, package.json and a nested public_html sitting
in it.

So the built site now sits at the top level of the repository, beside the
source, and public_html/ is gone. It is not a pretty tree. It is what
this host does, and the alternative was asking someone to change a
control panel setting every time the arrangement moved.

admin/ is both the panel's source and part of the build output -- the
build copies it verbatim, and the two are byte-identical -- so it stays
one directory rather than becoming two.

Because the source now shares the web root with the site, .htaccess has
to keep it unreachable. It already denied dotfiles, package.json and the
config files; it now also denies .github (which the .git rule misses,
needing a slash straight after "git" where this has "hub"), the my-app,
scripts and assets-original trees, every .md, and LICENSE. The .git rule
stops being a precaution here: the deploy puts .git in the document root
on every run by design, and it cannot be removed without giving up
automatic deploys, so those rules are the only thing between it and the
internet. The database password in that history still needs rotating.

publish-site.mjs replaces publish-public-html.mjs. It cannot empty the
target first -- the source lives there -- so it records what it wrote in
.site-manifest.json and removes those entries on the next run, which is
what stops a deleted page living at the top level for good.

Verified by serving the repository root the way Apache will:

  /                  200, correct title
  /cars/             200
  /fleet-check.html  200
  /assets/index-*.js 200, 352540 bytes
  /admin/install.php 200
  /admin/            500, and the body is "The panel cannot find its
                     configuration" -- correct, config.php is not in the
                     repository

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0128YzbhrfGdegUSc9RrARRf

Author: claude

.github/workflows/public-html-is-current.yml

@@ -0,0 +1,69 @@
+# Fails when the site committed at the top level is not the current build.
+#
+# Hostinger's Git deployment clones this repository into the document root and
+# runs no build, so whatever sits at the top level IS the website. A change to
+# my-app/ or admin/ that does not also update those files never reaches the
+# server -- and nothing reports a problem. The deploy succeeds, the site keeps
+# serving the previous build, and the only symptom is that the thing you
+# changed is not there.
+#
+# This makes that failure loud. It builds, republishes, and fails if that
+# changed anything -- which means the committed site was stale.
+#
+# It writes nothing back and pushes nothing. The fix is a person running
+# `npm run publish:site` and committing, because a workflow that could commit
+# the fix would also be a workflow that can push to main unattended, which is a
+# far larger permission than catching a stale folder is worth.
+name: Site is current
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          cache: npm
+          cache-dependency-path: my-app/package-lock.json
+
+      - name: Install
+        working-directory: my-app
+        run: npm ci
+
+      - name: Build
+        working-directory: my-app
+        run: npm run build
+
+      - name: Republish and see whether anything moved
+        run: |
+          node scripts/publish-site.mjs
+
+          if git diff --quiet; then
+            echo "The committed site matches the build."
+            exit 0
+          fi
+
+          echo "::error::The site committed at the top level is not the current build, so these changes will not reach the website."
+          echo ""
+          echo "Hostinger clones this repository into the document root and runs no"
+          echo "build, so the site keeps serving whatever is committed here."
+          echo ""
+          echo "Fix it with:"
+          echo ""
+          echo "    npm run publish:site"
+          echo "    git add -A && git commit"
+          echo ""
+          echo "Out of date:"
+          git diff --name-only | sed 's/^/  /'
+          exit 1

.github/workflows/site-is-current.yml

@@ -85,14 +85,27 @@ ErrorDocument 404 /404.html
 # a request for /.git/config has a filename of "config" and sails straight
 # past it. This blocks the paths instead.
 #
-# It is here because a .git directory was found in the web root of this very
-# server. A served .git is not a tidiness problem -- standard tooling
-# reconstructs the entire repository from it, and this repository's history
-# contains a database password. The directory should not be on a web server at
-# all; this is the second line of defence for the day it comes back.
+# A served .git is not a tidiness problem -- standard tooling reconstructs the
+# entire repository from it, and this repository's history contains a database
+# password from before it was moved out.
+#
+# This is no longer a precaution. Hostinger's Git deployment clones the whole
+# repository into the document root, so .git is there on every deploy by
+# design, and cannot be removed without giving up automatic deploys. These
+# rules are what stands between it and the internet, which is also why the
+# password still needs rotating in hPanel rather than being considered handled.
 <IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteRule (^|/)\.(git|svn|hg|env|ssh)(/|$) - [F,L]
+
+  # .github is not caught above: the pattern needs a slash or the end of the
+  # path straight after "git", and this has "hub" there instead.
+  RewriteRule (^|/)\.github(/|$) - [F,L]
+
+  # The rest of the repository, which now sits in the web root beside the
+  # site. FilesMatch cannot express these because it matches one filename at a
+  # time, and what needs blocking here is whole trees.
+  RewriteRule ^(my-app|scripts|assets-original)(/|$) - [F,L]
 </IfModule>
 
 # Source and build files are not content either. None of these should ever
@@ -102,6 +115,16 @@ ErrorDocument 404 /404.html
   Require all denied
 </FilesMatch>
 
+# Documentation, which the deploy now puts in the web root: README.md,
+# CODE_OF_CONDUCT.md, LICENSE, and the note in photos/ describing how to name a
+# car photograph. None of it is secret and none of it is for visitors.
+<FilesMatch "\.md$">
+  Require all denied
+</FilesMatch>
+<Files "LICENSE">
+  Require all denied
+</Files>
+
 # The directory listing is off by default on most hosts, but not all, and an
 # open listing of the web root is a map of everything on the server.
 Options -Indexes

public_html/.htaccess .htaccesspublic_html/.htaccess renamed to .htaccess

@@ -0,0 +1,25 @@
+[
+  ".htaccess",
+  "404.html",
+  "CNAME",
+  "about",
+  "assets",
+  "bikes",
+  "blog",
+  "car-brezza.avif",
+  "cars",
+  "contact",
+  "favicon.svg",
+  "fleet-check.html",
+  "hero-car.webp",
+  "index.html",
+  "monthly",
+  "nri",
+  "open-road.webp",
+  "photos",
+  "robots.txt",
+  "sitemap.xml",
+  "tariff",
+  "tourist-vehicles",
+  "wedding-cars"
+]