edgepress 2026.10.12 → 2026.10.13

package/README.md

@@ -49,6 +49,16 @@ Use Node.js 22.12 or newer. Set the real site URL and operator contact in config
 
 Run `edgepress init` in a new project directory to scaffold a site pinned to the installed EdgePress release. The initializer keeps the existing package name and scripts.
 
+## Maintainer npm and GitHub releases
+
+Releases use **year.month.number of updates in that month**, not the calendar day. For example, `2026.10.12` is the twelfth update in October 2026; `2026.10.13` follows it, and November starts at `2026.11.1`. The release workflow uses **UTC** for the month boundary and checks `package.json`, existing `vYYYY.M.N` tags and published npm versions to avoid reusing a version.
+
+Once the npm package owner has configured **Trusted Publishing** at [npmjs.com](https://www.npmjs.com/package/edgepress/access), choose GitHub Actions with owner `jsw-teams`, repository `edgepress`, workflow filename **`publish.yml`**, and allow **`npm publish`** (not only staging). No environment name is used. This is a one-time npm-side setup; no long-lived `NPM_TOKEN` is required. Restrict traditional publish tokens after confirming the first successful trusted publish.
+
+To publish new source, a repository maintainer opens **Actions → Publish npm and GitHub Release → Run workflow** on `main`. The manual-only job installs Node 22 and npm 11, determines the next monthly update number, updates both package manifests, audits dependencies, runs the full browser test suite, builds the project and packs the source. Only after all checks pass does it push a non-force release commit and tag, publish that exact archive to npm with provenance, and create a GitHub Release containing the same `.tgz` and SHA-256 checksum. Ordinary pushes and PRs cannot trigger a publish.
+
+**Recovery:** If a run fails *after* pushing its version tag, do not launch a new release blindly: check whether the tag, npm version or GitHub Release already exists and reconcile the incomplete publish first. npm versions cannot be overwritten. Protected branches must explicitly permit the GitHub Actions bot to create the release commit/tag or use a maintainer-approved release branch process.
+
 ## External link prompts
 
 The optional local prompt shows the complete destination URL (including path, query and fragment) once, with no duplicate hostname, and lets the visitor return or continue. It makes no request to the destination before confirmation. Configure exact origins, not wildcard domains:
@@ -173,7 +183,7 @@ Project guides are published from content/pages/: project introduction, quick st
 
 Version 2026.10.1 starts the October 2026 release series. Read the [October release notes](content/posts/2026-10-01-edgepress-release-2026-10-1/). The September updates are recorded in the [request 1 notes](content/posts/2026-09-24-edgepress-release-2026-9-1/), [request 2 notes](content/posts/2026-09-25-edgepress-release-2026-9-2/), [request 3 notes](content/posts/2026-09-25-edgepress-release-2026-9-3/), [request 4 notes](content/posts/2026-09-25-edgepress-release-2026-9-4/), [request 5 notes](content/posts/2026-09-25-edgepress-release-2026-9-5/), [request 6 notes](content/posts/2026-09-25-edgepress-release-2026-9-6/), [request 7 notes](content/posts/2026-09-26-edgepress-release-2026-9-7/), [request 8 notes](content/posts/2026-09-26-edgepress-release-2026-9-8/), [request 9 notes](content/posts/2026-09-26-edgepress-release-2026-9-9/), and [request 10 notes](content/posts/2026-09-27-edgepress-release-2026-9-10/).
 
-This release publishes page media from content/assets/, updates Wrangler to 4.144.0, and adds scheduled dependency checks and version-scoped Codex Security scans. Optional services remain disabled until a visitor makes an explicit choice.
+This release publishes page media from content/assets/ and updates Wrangler to 4.144.0. GitHub Actions retains only scheduled and lockfile-change dependency security audits. Optional services remain disabled until a visitor makes an explicit choice.
 
 ## Journal categories, navigation, and author profiles
 
@@ -227,7 +237,7 @@ Multiple post lists on the same page share a displayed-article set: an article a
 
 ## Static platform deployment
 
-Run npm run deploy:cloudflare, npm run deploy:vercel, npm run deploy:netlify, npm run deploy:edgeone -- -n my-site, or npm run deploy:esa -- --name my-site. Platform authentication is required. GitHub Actions also provides a manual Deploy static website workflow using repository Secrets.
+Run npm run deploy:cloudflare, npm run deploy:vercel, npm run deploy:netlify, npm run deploy:edgeone -- -n my-site, or npm run deploy:esa -- --name my-site. Platform authentication is required. Deployments run locally; GitHub Actions is limited to dependency security audits.
 
 
 All platforms build dist/. CSS and JS are fingerprinted, with one-year immutable cache policies for Cloudflare, Vercel, Netlify and EdgeOne. ESA uses the same assets; set its browser and edge cache rules for hashed CSS/JS while leaving HTML short-lived. See the [deployment guide](content/pages/deployment/en.json) and [ESA build configuration](https://help.aliyun.com/en/edge-security-acceleration/esa/user-guide/build-pages).

package/config.yml

@@ -1,10 +1,10 @@
 # Site configuration (site, theme, privacy, optional consent services).
 # Build paths and enabled locales belong to edgepress.config.mjs.
-site:
-  timeZone: Asia/Taipei
-  title: EdgePress
-  description: A static website builder for Cloudflare Workers with editable pages, Markdown posts, themes, and plugins.
-  url: https://example.org
+site:
+  timeZone: Asia/Taipei
+  title: EdgePress
+  description: A static website builder for Cloudflare Workers with editable pages, Markdown posts, themes, and plugins.
+  url: https://example.org
   language: en
   dataSaver: # site (optional text view; requires the theme dataSaver assets)
     enabled: false
@@ -13,169 +13,169 @@ site:
     detectSlowConnection: false
     respectBrowserPreference: false
     promptAfterMs: 5000
-  head:
-    titleSuffix: ""
-    titleSeparator: " · "
-  header:
-    showBrand: true
-    brandLabel: ""
-  components:
-    header: true
-    primaryNavigation: true
-    languageNavigation: true
-    footer: true
-    footerNavigation: true
-  navigation:
-    - key: home
-      url: "@home"
-      labels:
-        en: Home
-        zh-CN: 首页
-    - key: guides
-      url: /project-introduction/
-      labels:
-        en: Guides
-        zh-CN: 项目指南
-    - key: quick-start
-      url: /quick-start/
-      labels:
-        en: Quick start
-        zh-CN: 快速入门
-    - key: posts
-      url: "@archives"
-      labels:
-        en: Posts
-        zh-CN: 文章
-    - key: search
-      url: "@search"
-      labels:
-        en: Search
-        zh-CN: 搜索
-  footerNavigation:
-    - key: privacy
-      url: /privacy-policy/
-      labels:
-        en: Privacy policy
-        zh-CN: 隐私政策
-    - key: feed
-      url: "@feed"
-      labels:
-        en: Atom feed
-        zh-CN: Atom 订阅
-  footer: ""
-  author:
-    name: toewpq
-    avatar: /edgepress/brand/avatar.png
-  seo:
-    author: toewpq
-    keywords:
-      - Markdown website builder
-      - Cloudflare Workers
-      - static site generator
-    image: https://example.org/edgepress/brand/og-image.png
-    robots: index,follow
-  agentSeo:
-    enabled: true
-    summary: A static website builder for Cloudflare Workers, with row-based editable pages, Markdown posts,
-      themes, plugins, and consent-gated integrations.
-    topics:
-      - Markdown website builder
-      - Cloudflare Workers
-      - composable page blocks
-      - plugin development
-    llmsTxt: true
-    agentCrawlers:
-      - GPTBot
-      - ClaudeBot
-      - PerplexityBot
-privacy:
-  controller:
-    name: toewpq
-    contact: toewpq@gmail.com
-  policyUrl: /privacy-policy/
-plugins:
-  consent:
-    enabled: true
-    proposedDate: 2026-09-26
-    effectiveDate: 2026-09-26
-    expiresDays: 180
-    services:
-      - id: cloudflare-web-analytics
-        provider: cloudflare-web-analytics
-        name:
-          en: Cloudflare Web Analytics
-          zh-CN: Cloudflare 网站分析
-        purpose:
-          en: Measure visits and page performance to improve this site, only after you opt in.
-          zh-CN: 在你同意后统计访问与页面性能，用于改进本站。
-        dataCategories:
-          en: Performance timing and page-view metrics; dimensions can include path, referrer, device, browser,
-            operating system, and country. Cloudflare receives the beacon request's source IP and says it
-            discards it at the nearest data center without storing it in core databases or logs.
-          zh-CN: 性能计时和页面浏览指标，维度可能包括页面路径、来源页、设备、浏览器、操作系统和国家或地区。Cloudflare 会在信标请求中接收来源 IP，并表示会在最近的数据中心将其丢弃，不保存到核心数据库或日志中。
-        recipient:
-          en: Cloudflare, Inc.
-          zh-CN: Cloudflare, Inc.
-        retention:
-          en: Unsampled beacon data is kept for 7 days, then aggregated to about 10% for long-term storage. Dashboard
-            history is available for 6 months.
-          zh-CN: 未采样的信标数据保留 7 天，之后会汇总为约 10% 的长期数据。仪表板可查看最近 6 个月的历史记录。
-        privacyUrl: https://developers.cloudflare.com/speed/observatory/rum-beacon/
-        token: 8347d72ba9f84e6783bf441e7832a80e
-      - id: youtube
-        provider: oembed
-        enabled: true
-        name: YouTube
-        purpose:
-          en: With your permission, load YouTube media and its player on request.
-          zh-CN: 在你同意后，按你的请求加载 YouTube 分享内容及播放器。
-        dataCategories:
-          en: Requested content URL, IP address, browser information; provider cookies may be used after loading.
-          zh-CN: 请求的内容链接、IP 地址、浏览器信息；加载后平台可能使用其 Cookie。
-        recipient: YouTube
-        retention:
-          en: The site keeps the consent choice for 180 days; provider retention follows its linked privacy policy.
-          zh-CN: 本站保存授权选择 180 天；平台处理与保留规则见所链接的隐私政策。
-        privacyUrl: https://policies.google.com/privacy
-        backendUrl: https://www.youtube.com
-        oembedEndpoint: https://www.youtube.com/oembed
-        sourceOrigins:
-          - https://www.youtube.com
-          - https://youtu.be
-          - https://youtube.com
-          - https://m.youtube.com
-        embedOrigins:
-          - https://www.youtube.com
-          - https://www.youtube-nocookie.com
-      - id: x-posts
-        provider: oembed
-        enabled: true
-        name: X
-        purpose:
-          en: With your permission, load X media and its player on request.
-          zh-CN: 在你同意后，按你的请求加载 X 分享内容及播放器。
-        dataCategories:
-          en: Requested content URL, IP address, browser information; provider cookies may be used after loading.
-          zh-CN: 请求的内容链接、IP 地址、浏览器信息；加载后平台可能使用其 Cookie。
-        recipient: X
-        retention:
-          en: The site keeps the consent choice for 180 days; provider retention follows its linked privacy policy.
-          zh-CN: 本站保存授权选择 180 天；平台处理与保留规则见所链接的隐私政策。
-        privacyUrl: https://x.com/en/privacy
-        backendUrl: https://x.com
-        oembedEndpoint: https://publish.x.com/oembed
-        sourceOrigins:
-          - https://x.com
-          - https://twitter.com
-          - https://www.x.com
-          - https://www.twitter.com
-        embedOrigins:
-          - https://platform.x.com
-          - https://platform.twitter.com
-          - https://syndication.twitter.com
-          - https://cdn.syndication.twimg.com
-          - https://pbs.twimg.com
-          - https://abs.twimg.com
-          - https://video.twimg.com
-        embedScripts:
-          - https://platform.x.com/widgets.js
+  head:
+    titleSuffix: ""
+    titleSeparator: " · "
+  header:
+    showBrand: true
+    brandLabel: ""
+  components:
+    header: true
+    primaryNavigation: true
+    languageNavigation: true
+    footer: true
+    footerNavigation: true
+  navigation:
+    - key: home
+      url: "@home"
+      labels:
+        en: Home
+        zh-CN: 首页
+    - key: guides
+      url: /project-introduction/
+      labels:
+        en: Guides
+        zh-CN: 项目指南
+    - key: quick-start
+      url: /quick-start/
+      labels:
+        en: Quick start
+        zh-CN: 快速入门
+    - key: posts
+      url: "@archives"
+      labels:
+        en: Posts
+        zh-CN: 文章
+    - key: search
+      url: "@search"
+      labels:
+        en: Search
+        zh-CN: 搜索
+  footerNavigation:
+    - key: privacy
+      url: /privacy-policy/
+      labels:
+        en: Privacy policy
+        zh-CN: 隐私政策
+    - key: feed
+      url: "@feed"
+      labels:
+        en: Atom feed
+        zh-CN: Atom 订阅
+  footer: ""
+  author:
+    name: toewpq
+    avatar: /edgepress/brand/avatar.png
+  seo:
+    author: toewpq
+    keywords:
+      - Markdown website builder
+      - Cloudflare Workers
+      - static site generator
+    image: https://example.org/edgepress/brand/og-image.png
+    robots: index,follow
+  agentSeo:
+    enabled: true
+    summary: A static website builder for Cloudflare Workers, with row-based editable pages, Markdown posts,
+      themes, plugins, and consent-gated integrations.
+    topics:
+      - Markdown website builder
+      - Cloudflare Workers
+      - composable page blocks
+      - plugin development
+    llmsTxt: true
+    agentCrawlers:
+      - GPTBot
+      - ClaudeBot
+      - PerplexityBot
+privacy:
+  controller:
+    name: toewpq
+    contact: toewpq@gmail.com
+  policyUrl: /privacy-policy/
+plugins:
+  consent:
+    enabled: true
+    proposedDate: 2026-09-26
+    effectiveDate: 2026-09-26
+    expiresDays: 180
+    services:
+      - id: cloudflare-web-analytics
+        provider: cloudflare-web-analytics
+        name:
+          en: Cloudflare Web Analytics
+          zh-CN: Cloudflare 网站分析
+        purpose:
+          en: Measure visits and page performance to improve this site, only after you opt in.
+          zh-CN: 在你同意后统计访问与页面性能，用于改进本站。
+        dataCategories:
+          en: Performance timing and page-view metrics; dimensions can include path, referrer, device, browser,
+            operating system, and country. Cloudflare receives the beacon request's source IP and says it
+            discards it at the nearest data center without storing it in core databases or logs.
+          zh-CN: 性能计时和页面浏览指标，维度可能包括页面路径、来源页、设备、浏览器、操作系统和国家或地区。Cloudflare 会在信标请求中接收来源 IP，并表示会在最近的数据中心将其丢弃，不保存到核心数据库或日志中。
+        recipient:
+          en: Cloudflare, Inc.
+          zh-CN: Cloudflare, Inc.
+        retention:
+          en: Unsampled beacon data is kept for 7 days, then aggregated to about 10% for long-term storage. Dashboard
+            history is available for 6 months.
+          zh-CN: 未采样的信标数据保留 7 天，之后会汇总为约 10% 的长期数据。仪表板可查看最近 6 个月的历史记录。
+        privacyUrl: https://developers.cloudflare.com/speed/observatory/rum-beacon/
+        token: 8347d72ba9f84e6783bf441e7832a80e
+      - id: youtube
+        provider: oembed
+        enabled: true
+        name: YouTube
+        purpose:
+          en: With your permission, load YouTube media and its player on request.
+          zh-CN: 在你同意后，按你的请求加载 YouTube 分享内容及播放器。
+        dataCategories:
+          en: Requested content URL, IP address, browser information; provider cookies may be used after loading.
+          zh-CN: 请求的内容链接、IP 地址、浏览器信息；加载后平台可能使用其 Cookie。
+        recipient: YouTube
+        retention:
+          en: The site keeps the consent choice for 180 days; provider retention follows its linked privacy policy.
+          zh-CN: 本站保存授权选择 180 天；平台处理与保留规则见所链接的隐私政策。
+        privacyUrl: https://policies.google.com/privacy
+        backendUrl: https://www.youtube.com
+        oembedEndpoint: https://www.youtube.com/oembed
+        sourceOrigins:
+          - https://www.youtube.com
+          - https://youtu.be
+          - https://youtube.com
+          - https://m.youtube.com
+        embedOrigins:
+          - https://www.youtube.com
+          - https://www.youtube-nocookie.com
+      - id: x-posts
+        provider: oembed
+        enabled: true
+        name: X
+        purpose:
+          en: With your permission, load X media and its player on request.
+          zh-CN: 在你同意后，按你的请求加载 X 分享内容及播放器。
+        dataCategories:
+          en: Requested content URL, IP address, browser information; provider cookies may be used after loading.
+          zh-CN: 请求的内容链接、IP 地址、浏览器信息；加载后平台可能使用其 Cookie。
+        recipient: X
+        retention:
+          en: The site keeps the consent choice for 180 days; provider retention follows its linked privacy policy.
+          zh-CN: 本站保存授权选择 180 天；平台处理与保留规则见所链接的隐私政策。
+        privacyUrl: https://x.com/en/privacy
+        backendUrl: https://x.com
+        oembedEndpoint: https://publish.x.com/oembed
+        sourceOrigins:
+          - https://x.com
+          - https://twitter.com
+          - https://www.x.com
+          - https://www.twitter.com
+        embedOrigins:
+          - https://platform.x.com
+          - https://platform.twitter.com
+          - https://syndication.twitter.com
+          - https://cdn.syndication.twimg.com
+          - https://pbs.twimg.com
+          - https://abs.twimg.com
+          - https://video.twimg.com
+        embedScripts:
+          - https://platform.x.com/widgets.js