fix(site): drop host-based redirect rejected by Workers assets

[hyperpolymath]

Summary

Every pages-deploy.yml run failed. This PR fixes the last of the causes: site/_redirects had a host-based rule (https://www.boj-server.net/* → apex). That is Pages syntax. Workers static assets accept only relative source paths, so the API rejected the upload with Line 5: Only relative URLs are allowed [code: 100324]. The missing Cloudflare secrets were the other cause; they were set on 2026-10-08.

The www → apex canonicalisation is now a zone Redirect Rule in the Cloudflare dashboard, not a line in this file.

Type of change

• Bug fix (site deploy)

📌 New pins

• Head SHA: 20cdd0560e1f8185155c4e1f7a3976a1613dbb13
• None added or changed. No uses:, actions.lock, lockfile or container digest is touched.

Changes

• site/_redirects: removed the host-based www → apex rule. Updated the header comment to say why and where that redirect now lives.

RSR Quality Checklist

Required

• Tests pass: verified by deploying this branch for real (see Testing). No code is touched.
• Code is formatted: not applicable, this is a redirects data file.
• Linter is clean: no lintable source changed.
• No banned language patterns
• No unsafe blocks: not applicable.
• No banned functions: not applicable.
• SPDX license headers present: the existing MPL-2.0 header is kept.
• No secrets, credentials, or .env files included

As Applicable

• .machine_readable/*.a2ml: not applicable. A2ML is retired (D308), and no project state changed.
• Documentation updated: not applicable, no user-facing docs change. The site's own behaviour is unchanged except www handling.
• TOPOLOGY.md: not applicable, the architecture is unchanged.
• CHANGELOG: not applicable, deploy config only and not part of the released package.
• New dependencies: none.
• ABI/FFI: not applicable.

Testing

gh workflow run pages-deploy.yml --ref fix/workers-redirects → run 37743820199 succeeded (Current Version ID 8c990a8e…). On main, run 37743707914 failed with code 100324. Then curl -sI against boj-server.paraordinate.workers.dev:

• / → 200 text/html
• /assets/social-preview.png → 200 image/png
• /registry → 302 to github.com/hyperpolymath/boj-server-cartridges. The remaining absolute-destination rules are accepted.

boj-server.net stays 404 until the custom domain is attached to the Worker; that is a dashboard step, not code.

Pre-existing red checks (deferred)

Both also fail on main and are unrelated to this one-file change:

• SonarQube is deferred to Three pre-existing red non-required checks on main: Allowlist Preflight (empty GH_TOKEN), Workflow security linter (duplicate with in abi-drift.yml), SonarQube (403) #338.
• governance / UUID v7 conformance is deferred to governance / UUID v7 conformance is red on main: v5 UUID literal in .machine_readable/CLADE.a2ml #347.

Screenshots

Not applicable.

🤖 Generated with Claude Code

https://claude.ai/code/session_019j8She9eTFx54r6aL6sCHP

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d2807858-67c7-4b76-a727-a28a8d17120b

📥 Commits

Reviewing files that changed from the base of the PR and between 68c9e96 and 20cdd05.

📒 Files selected for processing (1)

• site/_redirects

 ________________________________________________________________________________________________
< Sign your work. Craftsmen of an earlier age were proud to sign their work. You should be, too. >
 ------------------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Hypatia Security Scan

Findings: 111 issues detected

Severity	Count
🔴 Critical	10
🟠 High	16
🟡 Medium	85

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `sonarqube` in build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sonarqube"
  },
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "reason": "Job `deploy` in pages-deploy.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deploy"
  },
  {
    "reason": "Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
    "type": "secret_action_without_presence_gate",
    "file": ".github/workflows/instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high",
    "fix_recipe": "add_secret_presence_gate"
  },
  {
    "reason": "codeql.yml does not list `language: actions` in its matrix, but the repo has workflow files. CodeQL's `actions` language scans workflow YAML for injection and other CI/CD-specific weaknesses — every repo with workflows benefits. Add an entry to `matrix.include` with `language: actions` + `build-mode: none`.",
    "type": "codeql_missing_actions_language",
    "file": ".github/workflows/codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "fix_recipe": "add_codeql_actions_language"
  },
  {
    "line": 39,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 46,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 32,
    "reason": "job in .github/workflows/build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/build.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/container-publish.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/container-publish.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence