Merge pull request #38 from niteeshkanna-sh/claude/stoic-rubin-fnglq7

Put the site at the top level, where the deploy actually lands

Author: niteeshkanna-sh

.github/workflows/public-html-is-current.yml

@@ -0,0 +1,69 @@
+# Fails when the site committed at the top level is not the current build.
+#
+# Hostinger's Git deployment clones this repository into the document root and
+# runs no build, so whatever sits at the top level IS the website. A change to
+# my-app/ or admin/ that does not also update those files never reaches the
+# server -- and nothing reports a problem. The deploy succeeds, the site keeps
+# serving the previous build, and the only symptom is that the thing you
+# changed is not there.
+#
+# This makes that failure loud. It builds, republishes, and fails if that
+# changed anything -- which means the committed site was stale.
+#
+# It writes nothing back and pushes nothing. The fix is a person running
+# `npm run publish:site` and committing, because a workflow that could commit
+# the fix would also be a workflow that can push to main unattended, which is a
+# far larger permission than catching a stale folder is worth.
+name: Site is current
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          cache: npm
+          cache-dependency-path: my-app/package-lock.json
+
+      - name: Install
+        working-directory: my-app
+        run: npm ci
+
+      - name: Build
+        working-directory: my-app
+        run: npm run build
+
+      - name: Republish and see whether anything moved
+        run: |
+          node scripts/publish-site.mjs
+
+          if git diff --quiet; then
+            echo "The committed site matches the build."
+            exit 0
+          fi
+
+          echo "::error::The site committed at the top level is not the current build, so these changes will not reach the website."
+          echo ""
+          echo "Hostinger clones this repository into the document root and runs no"
+          echo "build, so the site keeps serving whatever is committed here."
+          echo ""
+          echo "Fix it with:"
+          echo ""
+          echo "    npm run publish:site"
+          echo "    git add -A && git commit"
+          echo ""
+          echo "Out of date:"
+          git diff --name-only | sed 's/^/  /'
+          exit 1

.github/workflows/site-is-current.yml

@@ -85,14 +85,27 @@ ErrorDocument 404 /404.html
 # a request for /.git/config has a filename of "config" and sails straight
 # past it. This blocks the paths instead.
 #
-# It is here because a .git directory was found in the web root of this very
-# server. A served .git is not a tidiness problem -- standard tooling
-# reconstructs the entire repository from it, and this repository's history
-# contains a database password. The directory should not be on a web server at
-# all; this is the second line of defence for the day it comes back.
+# A served .git is not a tidiness problem -- standard tooling reconstructs the
+# entire repository from it, and this repository's history contains a database
+# password from before it was moved out.
+#
+# This is no longer a precaution. Hostinger's Git deployment clones the whole
+# repository into the document root, so .git is there on every deploy by
+# design, and cannot be removed without giving up automatic deploys. These
+# rules are what stands between it and the internet, which is also why the
+# password still needs rotating in hPanel rather than being considered handled.
 <IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteRule (^|/)\.(git|svn|hg|env|ssh)(/|$) - [F,L]
+
+  # .github is not caught above: the pattern needs a slash or the end of the
+  # path straight after "git", and this has "hub" there instead.
+  RewriteRule (^|/)\.github(/|$) - [F,L]
+
+  # The rest of the repository, which now sits in the web root beside the
+  # site. FilesMatch cannot express these because it matches one filename at a
+  # time, and what needs blocking here is whole trees.
+  RewriteRule ^(my-app|scripts|assets-original)(/|$) - [F,L]
 </IfModule>
 
 # Source and build files are not content either. None of these should ever
@@ -102,6 +115,16 @@ ErrorDocument 404 /404.html
   Require all denied
 </FilesMatch>
 
+# Documentation, which the deploy now puts in the web root: README.md,
+# CODE_OF_CONDUCT.md, LICENSE, and the note in photos/ describing how to name a
+# car photograph. None of it is secret and none of it is for visitors.
+<FilesMatch "\.md$">
+  Require all denied
+</FilesMatch>
+<Files "LICENSE">
+  Require all denied
+</Files>
+
 # The directory listing is off by default on most hosts, but not all, and an
 # open listing of the web root is a map of everything on the server.
 Options -Indexes

public_html/.htaccess .htaccesspublic_html/.htaccess renamed to .htaccess

@@ -0,0 +1,25 @@
+[
+  ".htaccess",
+  "404.html",
+  "CNAME",
+  "about",
+  "assets",
+  "bikes",
+  "blog",
+  "car-brezza.avif",
+  "cars",
+  "contact",
+  "favicon.svg",
+  "fleet-check.html",
+  "hero-car.webp",
+  "index.html",
+  "monthly",
+  "nri",
+  "open-road.webp",
+  "photos",
+  "robots.txt",
+  "sitemap.xml",
+  "tariff",
+  "tourist-vehicles",
+  "wedding-cars"
+]