Harden site build and search boundaries

.github/workflows/jekyll.yml

@@ -8,8 +8,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: jekyll-site-${{ github.ref }}
@@ -24,7 +22,7 @@ jobs:
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: "3.2.2"
+          ruby-version: "3.4.10"
           bundler: "2.5.23"
           bundler-cache: true
 
@@ -38,8 +36,10 @@ jobs:
 
       - name: Package Pages artifact
         run: |
-          tar --dereference --hard-dereference -cvf github-pages.tar _site
-          gzip -f github-pages.tar
+          tar --dereference \
+            --directory "${GITHUB_WORKSPACE}/_site" \
+            --create --file "${GITHUB_WORKSPACE}/github-pages.tar" .
+          gzip -f "${GITHUB_WORKSPACE}/github-pages.tar"
 
       - name: Upload artifact
         uses: actions/upload-artifact@v6
@@ -54,6 +54,9 @@ jobs:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     environment:

.github/workflows/rebuild-on-search-update.yml

@@ -8,8 +8,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 jobs:
   build:
@@ -20,7 +18,7 @@ jobs:
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: "3.2.2"
+          ruby-version: "3.4.10"
           bundler: "2.5.23"
           bundler-cache: true
 
@@ -31,8 +29,10 @@ jobs:
 
       - name: Package Pages artifact
         run: |
-          tar --dereference --hard-dereference -cvf github-pages.tar _site
-          gzip -f github-pages.tar
+          tar --dereference \
+            --directory "${GITHUB_WORKSPACE}/_site" \
+            --create --file "${GITHUB_WORKSPACE}/github-pages.tar" .
+          gzip -f "${GITHUB_WORKSPACE}/github-pages.tar"
 
       - name: Upload artifact
         uses: actions/upload-artifact@v6
@@ -45,6 +45,9 @@ jobs:
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/teaching-content-checks.yml

@@ -20,6 +20,9 @@ on:
       - "package.json"
       - "package-lock.json"
 
+permissions:
+  contents: read
+
 jobs:
   markdown-quality:
     runs-on: ubuntu-latest
@@ -35,16 +38,16 @@ jobs:
           cache: "npm"
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Run markdownlint for teaching content
         run: |
-          npx markdownlint-cli2 --config .markdownlint-cli2.jsonc \
+          ./node_modules/.bin/markdownlint-cli2 --config .markdownlint-cli2.jsonc \
             "_teaching/**/*.md" \
             "assets/images/teaching/README.md"
 
       - name: Check prettier formatting for teaching content
         run: |
-          npx prettier --check \
+          ./node_modules/.bin/prettier --check \
             "_teaching/**/*.md" \
             "assets/images/teaching/README.md"

.jekyllignore

@@ -1,4 +1,5 @@
 .cursor/
 .claude/
 CLAUDE.md
+AGENTS.md
 .gitignore

.ruby-version

@@ -1 +1 @@
-3.2.2
+3.4.10

CNAME

@@ -1 +1 @@
-https://comphy-lab.org
+comphy-lab.org

Gemfile

@@ -1,8 +1,10 @@
 source "https://rubygems.org"
 
-ruby "~> 3.2.0"
+ruby "~> 3.4.0"
 
 gem "jekyll", "~> 4.3.2"
+gem "base64"
+gem "csv"
 gem "webrick", "~> 1.8"
 gem "jekyll-sitemap"
 gem "jekyll-include-cache"

Gemfile.lock

@@ -3,9 +3,11 @@ GEM
   specs:
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
+    base64 (0.3.0)
     bigdecimal (3.1.9)
     colorator (1.1.0)
     concurrent-ruby (1.3.7)
+    csv (3.3.6)
     em-websocket (0.5.3)
       eventmachine (>= 0.12.9)
       http_parser.rb (~> 0)
@@ -176,6 +178,8 @@ PLATFORMS
   x86_64-linux-musl
 
 DEPENDENCIES
+  base64
+  csv
   jekyll (~> 4.3.2)
   jekyll-include-cache
   jekyll-seo-tag
@@ -184,7 +188,7 @@ DEPENDENCIES
   webrick (~> 1.8)
 
 RUBY VERSION
-   ruby 3.2.2p53
+   ruby 3.4.10
 
 BUNDLED WITH
    2.5.23

README.md

@@ -102,7 +102,7 @@ A static website for the Computational Multiphase Physics Laboratory, built with
 2. **Manual Setup (Alternative)**
 
    Prerequisites:
-   - Ruby `3.2.2` (matches `.ruby-version`)
+   - Ruby `3.4.10` (matches `.ruby-version`)
    - Bundler `2.5.23` (`gem install bundler -v 2.5.23`)
    - Node.js and npm (for linting and testing)
 
@@ -839,7 +839,7 @@ The repository uses automated tools to ensure code quality and consistency:
 
    ```bash
    npm install
-   npx husky install
+   ./node_modules/.bin/husky install
    ```
 
 #### Pre-commit Hooks

_config.yml

@@ -45,6 +45,7 @@ exclude:
   - .claude
   - .claude/**
   - CLAUDE.md
+  - AGENTS.md
   # Design-system handoff bundle — reference only, not built
   - comphy-lab-design-system
   - comphy-lab-design-system/**

_layouts/default.html

@@ -130,7 +130,9 @@
   <script defer src="/assets/js/command-palette.js"></script>
 
   <!-- JavaScript dependencies -->
-  <script defer src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+  <script defer src="https://cdn.jsdelivr.net/npm/marked@18.0.7/lib/marked.umd.js"
+    integrity="sha384-7njNzKcJUBdezPGfqUrIFizi2QkXJH0M6wF3o1h9GE/nce6X4YdecMwh31B19yTi"
+    crossorigin="anonymous"></script>
   <script defer src="https://cdn.jsdelivr.net/npm/dompurify@3.0.5/dist/purify.min.js"></script>
   <script defer src="https://cdn.jsdelivr.net/npm/fuse.js@6.6.2"></script>
   <script defer src="/assets/js/main.js"></script>

_layouts/history.html

@@ -82,7 +82,9 @@
 
   <!-- JavaScript dependencies -->
   <script defer src="/assets/js/utils.js"></script>
-  <script defer src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+  <script defer src="https://cdn.jsdelivr.net/npm/marked@18.0.7/lib/marked.umd.js"
+    integrity="sha384-7njNzKcJUBdezPGfqUrIFizi2QkXJH0M6wF3o1h9GE/nce6X4YdecMwh31B19yTi"
+    crossorigin="anonymous"></script>
   <script defer src="https://cdn.jsdelivr.net/npm/fuse.js@6.6.2"></script>
   <script defer src="/assets/js/main.js"></script>
   <script defer src="/assets/js/platform-utils.js"></script>

_layouts/join-us.html

@@ -59,7 +59,9 @@
   <script defer src="/assets/js/utils.js"></script>
   <script defer src="/assets/js/search-manager.js"></script>
   <script defer src="/assets/js/command-palette.js"></script>
-  <script defer src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+  <script defer src="https://cdn.jsdelivr.net/npm/marked@18.0.7/lib/marked.umd.js"
+    integrity="sha384-7njNzKcJUBdezPGfqUrIFizi2QkXJH0M6wF3o1h9GE/nce6X4YdecMwh31B19yTi"
+    crossorigin="anonymous"></script>
   <script defer src="https://cdn.jsdelivr.net/npm/dompurify@3.0.5/dist/purify.min.js"></script>
   <script defer src="https://cdn.jsdelivr.net/npm/fuse.js@6.6.2"></script>
   <script defer src="/assets/js/main.js"></script>

_layouts/team.html

@@ -76,7 +76,9 @@
   <!-- JavaScript dependencies - Core utilities first -->
   <script defer src="/assets/js/utils.js"></script>
   <script defer src="/assets/js/search-manager.js"></script>
-  <script defer src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+  <script defer src="https://cdn.jsdelivr.net/npm/marked@18.0.7/lib/marked.umd.js"
+    integrity="sha384-7njNzKcJUBdezPGfqUrIFizi2QkXJH0M6wF3o1h9GE/nce6X4YdecMwh31B19yTi"
+    crossorigin="anonymous"></script>
   <script defer src="https://cdn.jsdelivr.net/npm/fuse.js@6.6.2"></script>
   <script defer src="/assets/js/main.js"></script>
   <script defer src="/assets/js/platform-utils.js"></script>

about-legacy.html

@@ -0,0 +1,15 @@
+---
+layout: default
+title: Redirecting to CoMPhy Lab
+permalink: /about.html
+sitemap: false
+---
+
+<script>
+  window.location.replace("/");
+</script>
+
+<div class="container" style="text-align: center; padding: 40px 0;">
+  <p>About has moved to the homepage.</p>
+  <p>If you are not redirected automatically, <a href="/">click here</a>.</p>
+</div>

assets/css/join-us.css

@@ -202,7 +202,7 @@
   margin: 4rem 0;
 }
 
-.project-category h3 {
+.project-category > h3 {
   color: var(--join-subheading-color);
   font-size: 2.2rem;
   margin-bottom: 2rem;
@@ -211,16 +211,16 @@
   padding-bottom: 0;
 }
 
-.project-category h3:after {
+.project-category > h3:after {
   content: none;
 }
 
 /* Different accent colors for each category */
-.soft-matter-category h3:after {
+.soft-matter-category > h3:after {
   background-color: var(--join-phd-accent);
 }
 
-.free-surface-category h3:after {
+.free-surface-category > h3:after {
   background-color: var(--join-postdoc-accent);
 }
 
@@ -321,7 +321,7 @@
     font-size: 2.4rem;
   }
 
-  .project-category h3 {
+  .project-category > h3 {
     font-size: 2rem;
   }
 }

assets/css/research.css

@@ -700,15 +700,15 @@
 }
 
 .research-content .tags span:nth-of-type(3) {
-  background: var(--color-primary-alpha-5);
+  background: var(--color-primary-alpha-05);
 }
 
 [data-theme="dark"] .research-content .tags span:nth-of-type(3) {
   background: var(--color-blue-bright-alpha-10);
 }
 
 .research-content .tags span:nth-of-type(n + 4) {
-  background: var(--color-primary-alpha-5);
+  background: var(--color-primary-alpha-05);
 }
 
 [data-theme="dark"] .research-content .tags span:nth-of-type(n + 4) {

assets/css/styles.css

@@ -76,6 +76,7 @@
 
   /* Color System - Transparent Colors */
   --color-black-alpha-05: rgba(0, 0, 0, 0.05);
+  --color-black-alpha-08: rgba(0, 0, 0, 0.08);
   --color-black-alpha-10: rgba(0, 0, 0, 0.1);
   --color-black-alpha-15: rgba(0, 0, 0, 0.15);
   --color-black-alpha-20: rgba(0, 0, 0, 0.2);
@@ -89,6 +90,7 @@
   --color-white-alpha-30: rgba(255, 255, 255, 0.3);
   --color-white-alpha-35: rgba(255, 255, 255, 0.35);
   --color-white-alpha-40: rgba(255, 255, 255, 0.4);
+  --color-white-alpha-50: rgba(255, 255, 255, 0.5);
   --color-white-alpha-70: rgba(255, 255, 255, 0.7);
   --color-white-alpha-85: rgba(255, 255, 255, 0.85);
   --color-white-alpha-95: rgba(255, 255, 255, 0.95);
@@ -105,7 +107,9 @@
   --color-blue-bright-alpha-20: rgba(76, 110, 245, 0.2);
   --color-blue-bright-alpha-25: rgba(76, 110, 245, 0.25);
   --color-blue-bright-alpha-30: rgba(76, 110, 245, 0.3);
+  --color-blue-bright-alpha-40: rgba(76, 110, 245, 0.4);
   --color-blue-bright-alpha-50: rgba(76, 110, 245, 0.5);
+  --color-blue-bright-alpha-80: rgba(76, 110, 245, 0.8);
   --color-red-darker-alpha-20: rgba(250, 82, 82, 0.2);
   --color-header-base-alpha-15: rgba(104, 35, 109, 0.15);
   --color-header-base-alpha-20: rgba(104, 35, 109, 0.2);
@@ -129,6 +133,7 @@
   /* Transitions */
   --transition-fast: all 0.2s ease;
   --transition-medium: all 0.3s ease;
+  --loader-border-color: var(--color-black-alpha-10);
 
   /* Spacing System */
   --space-xs: 0.5rem;
@@ -2323,25 +2328,25 @@ section#featured:after,
 }
 
 /* Join page markdown refinements */
-.join-content .markdown-content h2 {
+.join-content.markdown-content h2 {
   font-size: 2.4rem;
   color: var(--color-primary);
   margin: 2.4rem 0 1.2rem;
   padding-bottom: 0.5rem;
   border-bottom: 2px solid var(--position-h2-border);
 }
 
-.join-content .markdown-content p {
+.join-content.markdown-content p {
   margin: 0 0 1.2rem;
 }
 
-.join-content .markdown-content ul,
-.join-content .markdown-content ol {
+.join-content.markdown-content ul,
+.join-content.markdown-content ol {
   margin: 0 0 1.2rem 2rem;
   padding: 0;
 }
 
-.join-content .markdown-content li {
+.join-content.markdown-content li {
   margin: 0.4rem 0;
 }
 

assets/js/main.js

@@ -445,7 +445,7 @@
         // If not on home page, let the browser handle the navigation
       } else if (href.startsWith("#")) {
         e.preventDefault();
-        const target = document.querySelector(href);
+        const target = document.getElementById(href.substring(1));
         if (target) {
           target.scrollIntoView({
             behavior: "smooth",