bump deps and rm vincent

.github/workflows/deploy.yml

@@ -68,18 +68,38 @@ jobs:
             sed -i 's|url: "https://social.dp.chanterelle.xyz"|url: "${{ vars.SOCIAL_DP_STAGING }}"|' _config.yml
           fi
 
-      # Decode the correct key based on the branch
+      # Decode the correct key based on the branch.
+      # Dependabot- and fork-triggered PR runs don't receive repository
+      # secrets, so PR builds fall back to a throwaway key — it's only used to
+      # build, never to publish. Push builds must have the real secret and
+      # fail hard if it's missing.
       - name: Decode Staging Key
         if: >
           github.ref == 'refs/heads/staging' ||
           (github.event_name == 'pull_request' && github.base_ref == 'staging')
-        run: echo ${{ secrets.ENCODED_DP_AP_KEY_STAGING }} | base64 --decode > /tmp/secret.key
+        run: |
+          if [ -n "${{ secrets.ENCODED_DP_AP_KEY_STAGING }}" ]; then
+            echo ${{ secrets.ENCODED_DP_AP_KEY_STAGING }} | base64 --decode > /tmp/secret.key
+          elif [ "${{ github.event_name }}" = "pull_request" ]; then
+            openssl genrsa -out /tmp/secret.key 2048
+          else
+            echo "ENCODED_DP_AP_KEY_STAGING is empty on a push build; refusing to deploy with a throwaway key" >&2
+            exit 1
+          fi
 
       - name: Decode Production Key
         if: >
           github.ref == 'refs/heads/master' ||
           (github.event_name == 'pull_request' && github.base_ref == 'master')
-        run: echo ${{ secrets.ENCODED_DP_AP_KEY_PRODUCTION }} | base64 --decode > /tmp/secret.key
+        run: |
+          if [ -n "${{ secrets.ENCODED_DP_AP_KEY_PRODUCTION }}" ]; then
+            echo ${{ secrets.ENCODED_DP_AP_KEY_PRODUCTION }} | base64 --decode > /tmp/secret.key
+          elif [ "${{ github.event_name }}" = "pull_request" ]; then
+            openssl genrsa -out /tmp/secret.key 2048
+          else
+            echo "ENCODED_DP_AP_KEY_PRODUCTION is empty on a push build; refusing to deploy with a throwaway key" >&2
+            exit 1
+          fi
 
       - name: Build Jekyll Site for Staging
         if: github.ref == 'refs/heads/staging' || (github.event_name == 'pull_request' && github.base_ref == 'staging')
@@ -116,12 +136,14 @@ jobs:
           refresh_token: ${{ secrets.DISTRIBUTED_PRESS_PRODUCTION_TOKEN}}
           site_url: hypha.coop
 
+      # Push-only: notifying the Fediverse and committing generated data are
+      # side effects that must not run for unmerged PRs targeting master.
       - name: Notify AP
-        if: github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.base_ref == 'master')
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
         run: bundle exec jekyll notify --key /tmp/secret.key --verbose --trace
 
       - name: Commit ActivityPub and Sequoia Data
-        if: github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.base_ref == 'master')
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
         uses: EndBug/add-and-commit@v9 
         with:
           add: '_data/activity_pub.yml,.sequoia-state.json,_posts'

Gemfile

@@ -14,7 +14,7 @@ gem "html-proofer"
 gem 'nokogiri'
 # gem 'ruby-brs'
 gem "webrick", "~> 1.9"
-gem 'sutty-liquid', '~> 0.12.2'
+gem 'sutty-liquid', '~> 0.13.0'
 
 group :jekyll_plugins do
   gem "jekyll-feed", 

Gemfile.lock

@@ -9,16 +9,29 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
-    base64 (0.2.0)
-    bigdecimal (3.1.9)
+    Ascii85 (2.0.1)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    afm (1.0.0)
+    async (2.42.0)
+      console (~> 1.29)
+      fiber-annotation
+      io-event (~> 1.11)
+      metrics (~> 0.12)
+      traces (~> 0.18)
+    base64 (0.3.0)
+    benchmark (0.5.0)
+    bigdecimal (3.3.1)
     climate_control (1.2.0)
     colorator (1.1.0)
-    concurrent-ruby (1.3.5)
-    crass (1.0.6)
-    csv (3.3.0)
-    distributed-press-api-client (0.5.1)
+    concurrent-ruby (1.3.7)
+    console (1.36.0)
+      fiber-annotation
+      fiber-local (~> 1.1)
+      json
+    crass (1.0.7)
+    csv (3.3.5)
+    distributed-press-api-client (0.5.4)
       addressable (~> 2.3, >= 2.3.0)
       climate_control
       dry-schema
@@ -27,28 +40,30 @@ GEM
       json (~> 2.1, >= 2.1.0)
       jwt (~> 2.6.0)
       nokogiri (~> 1.16)
-    dry-configurable (1.2.0)
-      dry-core (~> 1.0, < 2)
+    dry-configurable (1.4.0)
+      dry-core (~> 1.0)
       zeitwerk (~> 2.6)
-    dry-core (1.0.1)
+    dry-core (1.2.0)
       concurrent-ruby (~> 1.0)
+      logger
       zeitwerk (~> 2.6)
-    dry-inflector (1.1.0)
-    dry-initializer (3.1.1)
-    dry-logic (1.5.0)
+    dry-inflector (1.3.1)
+    dry-initializer (3.2.0)
+    dry-logic (1.6.0)
+      bigdecimal
       concurrent-ruby (~> 1.0)
-      dry-core (~> 1.0, < 2)
+      dry-core (~> 1.1)
       zeitwerk (~> 2.6)
-    dry-schema (1.13.4)
+    dry-schema (1.16.0)
       concurrent-ruby (~> 1.0)
       dry-configurable (~> 1.0, >= 1.0.1)
-      dry-core (~> 1.0, < 2)
-      dry-initializer (~> 3.0)
-      dry-logic (>= 1.4, < 2)
-      dry-types (>= 1.7, < 2)
+      dry-core (~> 1.1)
+      dry-initializer (~> 3.2)
+      dry-logic (~> 1.6)
+      dry-types (~> 1.9, >= 1.9.1)
       zeitwerk (~> 2.6)
-    dry-types (1.7.2)
-      bigdecimal (~> 3.0)
+    dry-types (1.9.1)
+      bigdecimal (>= 3.0)
       concurrent-ruby (~> 1.0)
       dry-core (~> 1.0)
       dry-inflector (~> 1.0)
@@ -61,32 +76,40 @@ GEM
       ffi (>= 1.15.0)
     eventmachine (1.2.7)
     fast_blank (1.0.1)
-    ffi (1.17.1-x86_64-darwin)
-    ffi (1.17.1-x86_64-linux-gnu)
+    ffi (1.17.4-x86_64-darwin)
+    ffi (1.17.4-x86_64-linux-gnu)
+    fiber-annotation (0.2.0)
+    fiber-local (1.1.0)
+      fiber-storage
+    fiber-storage (1.0.1)
     forwardable-extended (2.6.0)
-    google-protobuf (4.29.3-x86_64-darwin)
+    google-protobuf (4.35.1-x86_64-darwin)
       bigdecimal
-      rake (>= 13)
-    google-protobuf (4.29.3-x86_64-linux)
+      rake (~> 13.3)
+    google-protobuf (4.35.1-x86_64-linux-gnu)
       bigdecimal
-      rake (>= 13)
-    html-proofer (3.19.4)
+      rake (~> 13.3)
+    hashery (2.1.2)
+    html-proofer (5.2.1)
       addressable (~> 2.3)
-      mercenary (~> 0.3)
+      async (~> 2.1)
+      benchmark (~> 0.5)
       nokogiri (~> 1.13)
-      parallel (~> 1.10)
+      pdf-reader (~> 2.11)
       rainbow (~> 3.0)
       typhoeus (~> 1.3)
       yell (~> 2.0)
-    http_parser.rb (0.8.0)
-    httparty (0.22.0)
+      zeitwerk (~> 2.5)
+    http_parser.rb (0.8.1)
+    httparty (0.24.2)
       csv
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
     httparty-cache (0.0.6)
       httparty (~> 0.18)
-    i18n (1.14.7)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
+    io-event (1.19.1)
     jekyll (4.4.1)
       addressable (~> 2.4)
       base64 (~> 0.2)
@@ -106,69 +129,80 @@ GEM
       safe_yaml (~> 1.0)
       terminal-table (>= 1.8, < 4.0)
       webrick (~> 1.7)
-    jekyll-activity-pub (0.3.3)
+    jekyll-activity-pub (0.3.6)
       distributed-press-api-client (~> 0.5.0)
       jekyll (~> 4)
       marcel (~> 1)
-    jekyll-sass-converter (3.0.0)
-      sass-embedded (~> 1.54)
+    jekyll-sass-converter (3.1.0)
+      sass-embedded (~> 1.75)
     jekyll-watch (2.2.1)
       listen (~> 3.0)
-    json (2.7.2)
+    json (2.20.0)
     jwt (2.6.0)
-    kramdown (2.5.1)
-      rexml (>= 3.3.9)
+    kramdown (2.5.2)
+      rexml (>= 3.4.4)
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
     liquid (4.0.4)
-    listen (3.9.0)
+    listen (3.10.0)
+      logger
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
     logger (1.7.0)
-    loofah (2.24.0)
+    loofah (2.25.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    marcel (1.0.4)
+    marcel (1.2.1)
     mercenary (0.4.0)
+    metrics (0.15.0)
     mini_mime (1.1.5)
-    multi_xml (0.7.1)
-      bigdecimal (~> 3.1)
-    nokogiri (1.18.7-x86_64-darwin)
+    multi_xml (0.9.1)
+      bigdecimal (>= 3.1, < 5)
+    nokogiri (1.19.4-x86_64-darwin)
       racc (~> 1.4)
-    nokogiri (1.18.7-x86_64-linux-gnu)
+    nokogiri (1.19.4-x86_64-linux-gnu)
       racc (~> 1.4)
-    parallel (1.22.1)
     pathutil (0.16.2)
       forwardable-extended (~> 2.6)
-    public_suffix (6.0.1)
+    pdf-reader (2.15.1)
+      Ascii85 (>= 1.0, < 3.0, != 2.0.0)
+      afm (>= 0.2.1, < 2)
+      hashery (~> 2.0)
+      ruby-rc4
+      ttfunk
+    public_suffix (7.0.5)
     racc (1.8.1)
     rails-html-sanitizer (1.6.2)
       loofah (~> 2.21)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     rainbow (3.1.1)
-    rake (13.2.1)
+    rake (13.4.2)
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rexml (3.4.0)
-    rouge (4.5.1)
+    rexml (3.4.4)
+    rouge (4.7.0)
+    ruby-rc4 (0.1.5)
     safe_yaml (1.0.5)
-    sass-embedded (1.83.4-x86_64-darwin)
-      google-protobuf (~> 4.29)
-    sass-embedded (1.83.4-x86_64-linux-gnu)
-      google-protobuf (~> 4.29)
-    sutty-liquid (0.12.3)
+    sass-embedded (1.101.0-x86_64-darwin)
+      google-protobuf (~> 4.31)
+    sass-embedded (1.101.0-x86_64-linux-gnu)
+      google-protobuf (~> 4.31)
+    sutty-liquid (0.13.0)
       fast_blank (~> 1.0)
       jekyll (~> 4)
       rails-html-sanitizer (~> 1.6.0)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
+    traces (0.18.2)
+    ttfunk (1.8.0)
+      bigdecimal (~> 3.1)
     typhoeus (1.4.0)
       ethon (>= 0.9.0)
     unicode-display_width (2.6.0)
-    webrick (1.9.1)
+    webrick (1.9.2)
     yell (2.2.2)
-    zeitwerk (2.6.17)
+    zeitwerk (2.8.2)
 
 PLATFORMS
   x86_64-darwin-20
@@ -181,7 +215,7 @@ DEPENDENCIES
   jekyll-feed!
   logger
   nokogiri
-  sutty-liquid (~> 0.12.2)
+  sutty-liquid (~> 0.13.0)
   webrick (~> 1.9)
 
 BUNDLED WITH

Makefile

@@ -3,13 +3,13 @@ RUN = bundle exec
 start: ## Run jekyll server
 	$(RUN) jekyll serve --watch
 
-check: ## Check with htmlproofer
+check: ## Check with htmlproofer (5.x flags: --check-html removed, --internal-domains replaced by --swap-urls)
 	$(RUN) htmlproofer ./_site \
-	  --check-html \
 	  --allow-hash-href \
-	  --disable_external \
-	  --typhoeus-config '{ "headers": { "User-Agent": "Mozilla/5.0 (X11; Linux i686; rv:84.0) Gecko/20100101 Firefox/84.0" } }' \
-	  --internal-domains hypha.coop
+	  --allow-missing-href \
+	  --disable-external \
+	  --no-enforce-https \
+	  --swap-urls "https\://hypha.coop:,https\://staging.hypha.coop:"
 
 build: ## Build for web
 	@if [ "$(JEKYLL_ENV)" = "staging" ]; then \

_includes/picture.html

@@ -10,18 +10,21 @@
 @param :img_class [String]
 {%- endcomment -%}
 
+{%- capture srcset -%}
+  {%- for pixel_density in site.data.theme.pixel_densities %}
+    {% if include.width %}
+      {%- assign w = include.width | times: pixel_density -%}
+    {% elsif include.height %}
+      {%- assign h = include.height | times: pixel_density -%}
+    {% endif %}
+    {{- include.src | thumbnail: w, h | uri_escape }} {{ pixel_density }}x,
+  {% endfor -%}
+{%- endcapture -%}
+{%- assign srcset = srcset | strip -%}
 <picture class="{{ include.class }}">
-  <source
-    srcset="
-      {%- for pixel_density in site.data.theme.pixel_densities %}
-        {% if include.width %}
-          {%- assign w = include.width | times: pixel_density -%}
-        {% elsif include.height %}
-          {%- assign h = include.height | times: pixel_density -%}
-        {% endif %}
-        {{- include.src | thumbnail: w, h | uri_escape }} {{ pixel_density }}x,
-      {% endfor -%}
-      " />
+  {%- if srcset != "" %}
+  <source srcset="{{ srcset }}" />
+  {%- endif %}
 
   <img
     class="{{ include.img_class }}"