Redesign the site and harden it for 2026

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: bundler
+    directory: /
+    schedule:
+      interval: monthly
+    # Wait a week before proposing a new release, so a compromised or broken
+    # version has time to be caught upstream.
+    cooldown:
+      default-days: 7
+    groups:
+      gems:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]

.github/workflows/pages.yml

@@ -0,0 +1,63 @@
+# Builds the site with the gems in Gemfile.lock and deploys it to GitHub Pages.
+# The default Pages builder ignores plugins such as jekyll-archives, which left
+# tag and year archive links returning 404.
+#
+# One-time setup: Settings > Pages > Build and deployment > Source: GitHub Actions.
+#
+# Actions are pinned to full commit SHAs; Dependabot keeps them current.
+name: Build and deploy site
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pages-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
+        with:
+          ruby-version: '3.4'
+          bundler-cache: true
+
+      - name: Build
+        run: bundle exec jekyll build
+        env:
+          JEKYLL_ENV: production
+
+      - name: Check blog pages
+        run: bundle exec ruby scripts/check_blogs.rb
+
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        if: github.event_name != 'pull_request'
+        with:
+          path: _site
+
+  deploy:
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master'
+    needs: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.gitignore

@@ -2,3 +2,5 @@ _site
 .sass-cache
 .DS_Store
 .jekyll-cache
+vendor/
+.bundle/

.well-known/security.txt

@@ -0,0 +1,5 @@
+Contact: https://github.com/pythonindia/bangalore.python.org.in/security/advisories/new
+Expires: 2027-10-31T00:00:00.000Z
+Policy: https://github.com/pythonindia/bangalore.python.org.in/security/policy
+Preferred-Languages: en
+Canonical: https://bangalore.pythonindia.org/.well-known/security.txt

404.html

@@ -0,0 +1,14 @@
+---
+layout: page
+title: Page not found
+lede: This page has moved or never existed. Older tag and year links may point here.
+permalink: /404.html
+sitemap: false
+---
+<p>Try one of these instead:</p>
+<ul>
+    <li><a href="{{ '/' | relative_url }}">Home page</a>, with links to upcoming meetups and recent write-ups</li>
+    <li><a href="{{ '/blog/' | relative_url }}">Meetup blog</a>, every write-up by year</li>
+    <li><a href="{{ '/archives/' | relative_url }}">All posts</a>, including community articles</li>
+</ul>
+<p>Looking for something specific? Use <strong>Search</strong> at the top of the page.</p>

Gemfile

@@ -6,11 +6,11 @@ source "https://rubygems.org"
 #
 #     bundle exec jekyll serve
 #
+gem "jekyll", "~> 4.4"
 
 # If you have any plugins, put them here!
 gem 'wdm', '>= 0.1.0' if Gem.win_platform?
 group :jekyll_plugins do
-    gem 'jekyll-feed'
     gem 'jekyll-sitemap'
     gem 'jekyll-archives'
     gem 'jekyll-paginate'

Gemfile.lock

@@ -1,80 +1,96 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.5)
-      public_suffix (>= 2.0.2, < 6.0)
+    addressable (2.9.2)
+      public_suffix (>= 2.0.2, < 8.0)
+    base64 (0.3.0)
+    bigdecimal (4.1.3)
     colorator (1.1.0)
-    concurrent-ruby (1.2.2)
+    concurrent-ruby (1.3.8)
+    csv (3.3.7)
     em-websocket (0.5.3)
       eventmachine (>= 0.12.9)
       http_parser.rb (~> 0)
     eventmachine (1.2.7)
-    ffi (1.16.3)
+    ffi (1.17.4)
+    ffi (1.17.4-x86_64-linux-gnu)
     forwardable-extended (2.6.0)
-    google-protobuf (3.25.1)
-    http_parser.rb (0.8.0)
-    i18n (1.14.1)
+    google-protobuf (4.36.2)
+      bigdecimal
+      rake (~> 13.3)
+    google-protobuf (4.36.2-x86_64-linux-gnu)
+      bigdecimal
+      rake (~> 13.3)
+    http_parser.rb (0.8.1)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
-    jekyll (4.3.2)
+    jekyll (4.4.1)
       addressable (~> 2.4)
+      base64 (~> 0.2)
       colorator (~> 1.0)
+      csv (~> 3.0)
       em-websocket (~> 0.5)
       i18n (~> 1.0)
       jekyll-sass-converter (>= 2.0, < 4.0)
       jekyll-watch (~> 2.0)
+      json (~> 2.6)
       kramdown (~> 2.3, >= 2.3.1)
       kramdown-parser-gfm (~> 1.0)
       liquid (~> 4.0)
-      mercenary (>= 0.3.6, < 0.5)
+      mercenary (~> 0.3, >= 0.3.6)
       pathutil (~> 0.9)
       rouge (>= 3.0, < 5.0)
       safe_yaml (~> 1.0)
       terminal-table (>= 1.8, < 4.0)
       webrick (~> 1.7)
-    jekyll-archives (2.2.1)
+    jekyll-archives (2.3.0)
       jekyll (>= 3.6, < 5.0)
-    jekyll-feed (0.17.0)
-      jekyll (>= 3.7, < 5.0)
     jekyll-paginate (1.1.0)
-    jekyll-sass-converter (3.0.0)
-      sass-embedded (~> 1.54)
+    jekyll-sass-converter (3.1.0)
+      sass-embedded (~> 1.75)
     jekyll-sitemap (1.4.0)
       jekyll (>= 3.7, < 5.0)
     jekyll-watch (2.2.1)
       listen (~> 3.0)
-    kramdown (2.4.0)
-      rexml
+    json (2.21.2)
+    kramdown (2.5.2)
+      rexml (>= 3.4.4)
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
     liquid (4.0.4)
-    listen (3.8.0)
+    listen (3.10.1)
+      logger
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
+    logger (1.7.0)
     mercenary (0.4.0)
     pathutil (0.16.2)
       forwardable-extended (~> 2.6)
-    public_suffix (5.0.4)
-    rake (13.1.0)
+    public_suffix (7.0.5)
+    rake (13.4.2)
     rb-fsevent (0.11.2)
-    rb-inotify (0.10.1)
+    rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rexml (3.2.6)
-    rouge (4.2.0)
+    rexml (3.4.4)
+    rouge (4.7.0)
     safe_yaml (1.0.5)
-    sass-embedded (1.69.5)
-      google-protobuf (~> 3.23)
-      rake (>= 13.0.0)
+    sass-embedded (1.108.1)
+      google-protobuf (~> 4.31)
+      rake (~> 13.3)
+    sass-embedded (1.108.1-x86_64-linux-gnu)
+      google-protobuf (~> 4.31)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
-    unicode-display_width (2.5.0)
-    webrick (1.8.1)
+    unicode-display_width (2.6.0)
+    webrick (1.9.2)
 
 PLATFORMS
   ruby
+  x86_64-linux
 
 DEPENDENCIES
+  jekyll (~> 4.4)
   jekyll-archives
-  jekyll-feed
   jekyll-paginate
   jekyll-sitemap
   kramdown

README.md

@@ -4,7 +4,13 @@ Source code for Bangalore Python User Group Blog. Read blog at  https://bangalor
 
 ## Setup Locally:
 
-Follow [Testing your GitHub Pages site locally with Jekyll](https://docs.github.com/en/pages/setting-up-a-github-pages-site-with-jekyll/testing-your-github-pages-site-locally-with-jekyll)
+You need Ruby 3.2 or newer. Install the gems inside the project, so you don't
+need write access to the system gem directory:
+
+```sh
+bundle config set --local path vendor/bundle
+bundle install
+```
 
 ## Run:
 
@@ -14,14 +20,41 @@ bundle exec jekyll serve
 
 You can use `--livereload` to keep auto-updating changes.
 
+To preview the production build (Content-Security-Policy and analytics on):
+
+```sh
+JEKYLL_ENV=production bundle exec jekyll build
+```
+
 ## Blog checks
 
 ```sh
 bundle exec ruby scripts/check_blogs.rb
 ```
 
 This renders the site and checks meetup pagination, community article cards,
-and the Giscus embed, including posts that opt out of comments.
+and the Giscus embed, including posts that opt out of comments. It also checks
+that templates have no inline scripts or event handlers, that the
+Content-Security-Policy is present, that the search index is complete and
+that `.well-known/security.txt` has not expired. The same checks run on every
+pull request.
+
+## Deployment
+
+`.github/workflows/pages.yml` builds the site with the gems in `Gemfile.lock`
+and deploys it to GitHub Pages on every push to `master`. Repository settings
+must have Pages > Build and deployment > Source set to **GitHub Actions**; the
+default Pages builder skips `jekyll-archives`, so tag and year pages would 404.
+
+## Security
+
+- The Content-Security-Policy is in `_includes/head.html`. Templates must not
+  use inline `<script>` blocks or `on*=` attributes; put code in
+  `assets/js/`. When a post needs a new embed (an iframe from a new site),
+  add that host to `frame-src` rather than loosening the policy.
+- Third-party scripts in post Markdown (old Twitter and Speaker Deck embeds)
+  are blocked by the policy; the posts link to the original instead.
+- Report vulnerabilities as described in [SECURITY.md](SECURITY.md).
 
 ## Blog comments
 
@@ -40,6 +73,9 @@ strict matching, so changing a title or the site's domain keeps the same thread;
 changing its permalink requires migrating the discussion mapping. Giscus creates
 the discussion when the first comment or reaction is submitted.
 
+Posts can set `image_alt` in front matter to describe the cover photo for
+screen reader users, for example `image_alt: "Attendees at the EPAM office"`.
+
 Community posts belong in `_posts/community/` and inherit `hidden: true`.
 This excludes them from meetup pagination while keeping them published in the
 Community Blog, archives, and author pages.

SECURITY.md

@@ -0,0 +1,26 @@
+# Security policy
+
+This repository is the source of <https://bangalore.pythonindia.org>, a static
+Jekyll site served by GitHub Pages.
+
+## Reporting a vulnerability
+
+Please report security issues privately through
+[GitHub private vulnerability reporting](https://github.com/pythonindia/bangalore.python.org.in/security/advisories/new),
+not in a public issue, pull request or Discord channel.
+
+Include the affected URL or file, what an attacker could do, and steps to
+reproduce. A volunteer maintainer will acknowledge the report as soon as they
+can and keep you updated in the advisory.
+
+In scope: this website and this repository, including its GitHub Actions
+workflows. Out of scope: third-party services we link to or embed (Meetup,
+Luma, Discord, Giscus, YouTube) — please report those to the service.
+
+## Maintainer notes
+
+- Private vulnerability reporting must be enabled under
+  Settings > Code security for the link above to work.
+- `.well-known/security.txt` has an `Expires` date; renew it before then.
+- The Content-Security-Policy lives in `_includes/head.html`. Add a host there
+  when a post needs a new embed, rather than loosening the policy.