[gerardrecinto]

Second half of #684, split so each PR stays small enough to review. #684 keeps the site changes.

What changed

• deploy-site.yml also triggers on verify/, inmemory/, go.mod and go.sum, pins wrangler to 4.151.3 inline, and has a rollback job that runs wrangler rollback when verify-live fails after a production deploy.
• uptime.yml also probes https://joltrinhq.com/.
• dependabot-automerge.yml only auto-merges patch and minor updates. claude-remediation.yml only answers owner, member and collaborator comments.
• HSTS gets includeSubDomains, /.well-known/security.txt ships with the site, and local launch notes are gitignored.

Not changed

• workers_dev and preview_urls stay true because the preview deploy reads the preview URL.
• No package.json or lock file change. The inline pin avoids a 1,500 line lockfile diff.

Testing

• Workflow files parse as YAML. Nothing here has run on GitHub yet: the rollback job runs only if verify-live fails on a production deploy, and the pinned wrangler first runs on the next merge to master.

Thanks,
Gerard Recinto

[github-actions]

Gemini PR Review

Reviewed commit: a38d8fa5c319cec2aa38e692aa52f1ad14af25ac
Verdict: PASS

• Security hardening: The claude-remediation.yml workflow now correctly restricts its trigger to OWNER, MEMBER, or COLLABORATOR, preventing unauthorized use of resources or API keys.
• Security hardening: The dependabot-automerge.yml workflow now correctly prevents major version dependency updates from being auto-merged, requiring human review for potentially breaking changes.
• Security hardening: The deploy/cloudflare/_headers file now includes includeSubDomains in the Strict-Transport-Security header, extending HSTS protection to subdomains.
• Security best practice: The new demo/.well-known/security.txt file provides a standard contact point for security researchers, improving vulnerability disclosure.
• Robustness: The deploy-site.yml workflow now includes a rollback job that automatically reverts a production deploy if the subsequent verify-live job fails. This improves site availability and recovers from deployment issues. Secrets are handled securely.
• Correctness: The deploy-site.yml workflow pins the wrangler version to 4.151.3, ensuring consistent behavior across runs and preventing unexpected changes from newer wrangler versions.
• Monitoring: The uptime.yml workflow now includes a check for the marketing site (https://joltrinhq.com/), expanding the scope of live application monitoring.