The website for starhaven.io.
Use a Node.js version satisfying engines.node in package.json. Install the
dependencies exactly as locked, then start Astro:
npm ci --strict-allow-scripts
npm run devThe project explicitly denies its current dependency install scripts. just npm-policy verifies the lockfile policy, and .npmrc enables strict
install-script checks by default for local npm installs.
Run just install-hooks once per clone to enable the git hooks (a pre-push just check and DCO sign-off enforcement).
For local verification, run just check. It runs typos, Vale, zizmor,
formatting, type checks, unit tests, a production build, post-build smoke
assertions, and a Wrangler dry-run. The full gate requires these local tools:
brew install just typos-cli vale zizmorVale checks prose in README.md and src/content/blog/. The optional just lychee recipe checks links in the built site and requires brew install lychee.
CI downloads Vale and lychee from literal release URLs and verifies their pinned SHA-256 digests before extraction. Renovate updates each release and digest together through the shared fleet preset. Internal link checks fail on errors or an empty scan and publish their report in the job summary.
Blog posts live in src/content/blog/ and use YYYY-MM-DD-slug.md filenames.
The filename supplies the publication date, determines chronological ordering,
and forms the date-prefixed post URL, so do not add a separate pubDate
frontmatter field. An optional updatedDate YAML field in YYYY-MM-DD format
supplies sitemap and article metadata and cannot precede the filename date.
Titles and descriptions must be plain text. Raw HTML, footnotes, non-HTTPS web
links, credentialed links, and off-site images in blog Markdown fail the build.
RSS descriptions are emitted as plain text, and RSS post bodies retain safe
external links but include images only when they use HTTPS on starhaven.io.
The CI workflow deploys a protected main push only after that exact commit
passes the post-merge gate. The deployment publishes a revision receipt at
/.well-known/revision.json and verifies the public response before reporting
success.
npm run deploy is guarded for that trusted GitHub Actions path and is not a
local publication command. Use npm run deploy:dry to validate generated
Wrangler output without publishing.
This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0-only).
Prose (blog posts and site copy) is licensed separately under CC-BY-SA-4.0.
Copyright (C) 2026 Patrick Linnane