fix(public): enforce trust/support JSON-LD on the live site and deploy bundle - #127
Conversation
…y bundle
The Grok review finding ("six trust/support pages carry no JSON-LD while
the other six do") describes the live tinystudio.in, which has served the
2026-06-20 bundle (07acd07) since June 20. The repo fix is already merged
on main (PR #26 adds JSON-LD to every public page; test-public-structured-
data.mjs asserts all 12 pages), but the release lane's detectors only
proved JSON-LD on /contact/, so the finding could recur silently.
Close the detector blind spots so the acceptance is enforced end-to-end
once the release lane publishes:
- scripts/check-public-live-deploy.mjs: new section E asserts every one of
the 12 public paths returns 200 and carries exactly one
application/ld+json block, mirroring the repo-side invariant from PR #26
(currently fails live: 8 pages on the stale bundle have zero JSON-LD).
- scripts/prepare-public-deploy-bundle.mjs: NEUTRAL_PROOFS now asserts
JSON-LD survival for every remaining public page, so the filtered deploy
bundle fails closed if any page loses its structured data
(test-public-deploy-bundle.mjs: 62 -> 72 checks).
verify: node scripts/test-public-deploy-bundle.mjs (72 checks, 0 failures);
node scripts/test-public-structured-data.mjs (127 checks, 0 failures);
node scripts/check-public-live-deploy.mjs now reports the 8 live pages
missing JSON-LD, proving the detector catches the original finding;
git diff --check clean
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c132633144
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| { | ||
| label: "support page JSON-LD (07acd07 baseline)", | ||
| file: "support/index.html", | ||
| test: (html) => html.includes("application/ld+json"), |
There was a problem hiding this comment.
When npm run site:publish is invoked directly, these new bundle proofs are the only structured-data gate, but includes("application/ld+json") accepts duplicate blocks or even a non-script occurrence of that text. For example, duplicating the privacy page's JSON-LD block still lets bundle preparation exit successfully, despite the stated exactly-one invariant. Count actual JSON-LD script elements here so the production bundle fails closed as intended.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
Warning Review limit reached
Next review available in: 56 minutes Limit details: You’ve used the included review currently available. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Free Run ID: 📒 Files selected for processing (2)
ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Free Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe deployment scripts now define a JSON-LD proof for public pages. The live checker tests 12 routes for HTTP 200 responses and exactly one ChangesPublic deployment JSON-LD proofs
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This change strengthens JSON-LD validation for the live site and deployment bundle without introducing an actionable merge-blocking risk; it is merge-ready after normal checks and review. Note 🎁 Summarized by CodeRabbit FreeYour organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login. Comment |
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ea889a67c3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for (const path of PUBLIC_PATHS) { | ||
| const { status, body } = await get(path) | ||
| ok(status === 200, `${path} returns 200 (got ${status})`) | ||
| const blocks = (body.match(/<script\s+type="application\/ld\+json"[^>]*>/gi) || []).length |
There was a problem hiding this comment.
When a page's JSON-LD block is commented out, this raw-text regex still counts the <script type="application/ld+json"> text inside the HTML comment, so section E reports success even though browsers and crawlers see no structured-data element. Parse actual script elements—or at least remove HTML comments before counting—so the live acceptance check enforces the stated invariant.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
…-guard-20260812 # Conflicts: # scripts/check-public-live-deploy.mjs # scripts/prepare-public-deploy-bundle.mjs
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
Comment-block conflict only: keep main's managed-service snooze review disposition and this branch's proof-5 note about JSON-LD coverage.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
PR #123 landed its own section E (Cloudflare email obfuscation) in check-public-live-deploy.mjs. Kept both live checks and relabelled this branch section from E to F.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
check-public-live-deploy.mjs now carries sections A-G on main (E Cloudflare email #123, F JSON-LD #127, G footer tap-targets #110). Rather than resolve the overlapping hunks by hand, this takes main file verbatim and grafts this branch shared-footer copy proof onto it as section H. Repo check chain green.
1 participant
The item
[unreviewed-by-grok] Six trust/support pages carry no JSON-LD structured data while the other six public pages do
Root cause
The finding describes the live site (tinystudio.in), which has served the stale 2026-06-20 bundle (
07acd07) since June 20. Live JSON-LD coverage today: only/,/support/,/promptly/,/drishti/(4 of 12 pages);/contact/,/privacy/,/privacy-choices/,/terms/,/promptly/support/,/promptly/privacy/,/drishti/support/,/drishti/privacy/carry zero JSON-LD.The repo fix is already merged on main: PR #26 added JSON-LD to every public page and
test-public-structured-data.mjsasserts all 12 pages (127 checks, 0 failures). The release lane (#81) exists to publish main, but fail-closes without a Cloudflare Pages API token (one-time provisioning documented inpublish-public-site.mjs).What this PR closes: the detector blind spots
The instance was fixed in #26, but the release lane only proved JSON-LD on
/contact/— the exact finding could recur silently. This PR makes the acceptance enforced end-to-end:scripts/check-public-live-deploy.mjs— new section E asserts every one of the 12 public paths returns 200 and carries exactly oneapplication/ld+jsonblock (mirrors the PR fix(public): add JSON-LD structured data to trust and support pages #26 repo-side invariant). Run against the live site today it fails on exactly the pages the Grok review flagged.scripts/prepare-public-deploy-bundle.mjs—NEUTRAL_PROOFSnow asserts JSON-LD survival for every remaining public page, so the filtered deploy bundle fails closed before publish if any page loses its structured data (test-public-deploy-bundle.mjs: 62 -> 72 checks).Verification
node scripts/test-public-deploy-bundle.mjs— 72 checks, 0 failuresnode scripts/test-public-structured-data.mjs— 127 checks, 0 failuresnode scripts/check-public-live-deploy.mjs— section E now reports the 8 live pages missing JSON-LD (detector catches the original finding; passes only after the release lane publishes main)git diff --checkclean; all scripts passnode --checknpm testpasses except the pre-existing environmentalcheck-retention-automation.mjsfreshness failure, which fails identically at the base commit (cross-repo check againsttinystudio-in-autonomous-service, unrelated to this change)Note
The actual publish to production remains blocked on the documented one-time provisioning of a Cloudflare Pages-scoped token (
gh secret set CLOUDFLARE_API_TOKEN,CLOUDFLARE_ACCOUNT_ID=f670a698e17bf160c8e4679823e68916) — no repo secret or local wrangler auth exists.Summary by CodeRabbit
New Features
Documentation