From 1605cbeff6bb722452737454329a8e78fb54dbb1 Mon Sep 17 00:00:00 2001
From: rivassec <rivassec@rivassec.com>
Date: Fri, 11 Sep 2026 16:09:37 -0700
Subject: [PATCH] repo hygiene: disable direct-publish footgun, silence
 permanent build error

- make publish built with the DEV config (relative URLs, wrong
  canonicals, no feeds) and force-pushed gh-pages, bypassing every CI
  guard. Now fails with a pointer at the PR flow; deploys are
  Actions-only (deploy.yml).
- exclude content/tools/ from article/page scanning so the markdown
  reader stops logging an ERROR on the vendored VENDORED.md every
  build; the tool page itself is static-shipped and unaffected.
---
 Makefile       | 13 +++++++------
 pelicanconf.py |  6 +++++-
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/Makefile b/Makefile
index ad6d4a61..e5241b64 100644
--- a/Makefile
+++ b/Makefile
@@ -70,13 +70,14 @@ devserver:
 devserver-global:
 	"$(PELICAN)" -lr "$(INPUTDIR)" -o "$(OUTPUTDIR)" -s "$(CONFFILE)" $(PELICANOPTS) -b 0.0.0.0
 
-#publish:
-#	"$(PELICAN)" "$(INPUTDIR)" -o "$(OUTPUTDIR)" -s "$(PUBLISHCONF)" $(PELICANOPTS)
-
+# Direct publishing is intentionally disabled. It built with the DEV config
+# (pelicanconf.py: RELATIVE_URLS=True, wrong canonicals, no feeds) and
+# force-pushed gh-pages, bypassing every CI guard. Deploys happen only via
+# GitHub Actions (deploy.yml) on merge to main.
 publish:
-	pelican content -o output -s pelicanconf.py
-	ghp-import output -b gh-pages
-	git push origin gh-pages --force
+	@echo "ERROR: 'make publish' is disabled - it bypasses CI and deploys a dev-config build." >&2
+	@echo "Publish via the PR flow instead: branch -> PR -> checks -> merge to main (deploy.yml ships it)." >&2
+	@exit 1
 
 github: publish
 	ghp-import -m "Generate Pelican site" -b $(GITHUB_PAGES_BRANCH) "$(OUTPUTDIR)"
diff --git a/pelicanconf.py b/pelicanconf.py
index a91f15c4..8a60914d 100644
--- a/pelicanconf.py
+++ b/pelicanconf.py
@@ -43,7 +43,11 @@ def _asset_version() -> str:
 TWITTER_USERNAME = 'rivassec'
 
 PATH = "content"
-ARTICLE_EXCLUDES = ['_external', 'extra']
+# 'tools' is static-shipped (see STATIC_PATHS below); excluding it here stops
+# the markdown reader from logging an ERROR on tools/iam-blast-radius/VENDORED.md
+# ("could not find information about 'title'") on every single build.
+ARTICLE_EXCLUDES = ['_external', 'extra', 'tools']
+PAGE_EXCLUDES = ['_external', 'extra', 'tools']
 STATIC_PATHS = ['images', 'static']
 CUSTOM_CSS = 'static/custom.css'
 THEME = 'themes/Flex'