[lentago-claude-runner]

Closes #69

Adds an optional version_file input (default public/version.json, empty disables) to site-deploy.yml. A new step after checkout, before the pre-build command and Astro build, writes {sha, repo, built_at, run_url} with jq -n. Astro serves public/ verbatim, so each calling site exposes its deployed commit at /version.json, letting a probe check whether the live site matches the newest main.

Also documents the input in the workflow header and README, and adds a CHANGELOG (new file) entry under v1.3.0 (new optional input, so minor).

Notes:

• No tag or release created; the operator validates against a caller and cuts v1.3.0.
• Locally verified the jq command emits valid JSON; not yet run in a real caller workflow.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lentago/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: f6f6d8ca-16ac-4959-8376-c5700b587be5

📥 Commits

Reviewing files that changed from the base of the PR and between 9beb7d8 and 758bb72.

📒 Files selected for processing (3)

• .github/workflows/site-deploy.yml
• CHANGELOG.md
• README.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• New Features
  • Deployments can now include a version information file with the commit, repository, build time, and workflow run link. The file is created by default and can be disabled through the deployment configuration.
• Documentation
  • Updated the deployment guide and changelog with details about the version information file and its configuration.

Walkthrough

The site deployment workflow adds an optional version_file input. When the input is nonempty, the workflow writes commit and run metadata after checkout and before build commands. The README and changelog document the input and its default.

Changes

Site version metadata

Layer / File(s)	Summary
Configure and write version metadata .github/workflows/site-deploy.yml, README.md, CHANGELOG.md	The workflow adds a version_file input, defaulting to public/version.json, and writes JSON with the commit SHA, repository, UTC build time, and run URL when the input is nonempty. The README and changelog document the input and behavior.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 758bb

This change adds an optional version.json file written before the site build, and an empty input disables it. Its main remaining uncertainty is that it has not yet been run in a real caller workflow, which is normal validation before the release is cut.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 758bb

The change exposes commit, repository, and run identifiers after callers upgrade, without adding cloud permissions. No introduced security finding was established, but caller-specific publication, confidentiality, and rollback behavior remain unvalidated.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The new exposure can extend to each upgraded caller site that packages and serves the generated file. Public visitors could then learn its commit SHA, repository identity, build time, and run URL. The number of affected deployments and sensitivity of those identifiers are not established by the available caller evidence.

Trust Boundaries and Controls

• observed — The caller-selected path is handled as environment data with quoted shell expansions rather than inserted into shell source. Metadata uses jq --arg encoding. The path is not confined to the public directory, but callers already control a shell pre-build command and executable build content; unrestricted path selection alone does not establish newly gained authority.

Hardening Proposals

• proposed — Before upgrading a caller, confirm that publishing repository and run identifiers is acceptable and that its build preserves the file. Treat /version.json as deployment telemetry rather than authenticated provenance; use the existing digest-based attestation mechanism for provenance verification.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is specific, imperative, under 72 characters, and matches the linked issue and main workflow change.
Description check	✅ Passed	The description clearly explains the version metadata step, configuration, documentation updates, validation status, and release notes.
Linked Issues check	✅ Passed	Issue #69 coding requirements are met. .github/workflows/site-deploy.yml declares version_file with default public/version.json, skips the step only when the input is empty, and places the step …
Out of Scope Changes check	✅ Passed	The changed workflow, README documentation, and CHANGELOG.md entry all support issue #69. No unrelated change is evidenced.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}