mccormickt.github.io

Holds the source of my personal blog made using hugo and deployed with Github actions.

Standard.site on ATProto

Sequoia manages the publication, document IDs, record updates, and verification links. Posts need no manually assigned keys. GitHub Pages remains the canonical website. Automatic Bluesky feed posts are disabled.

Hugo exports published posts to public/.sequoia/content as temporary TOML-frontmatter Markdown files. These contain Hugo's canonical paths and rendered plain text, including shortcode output. Drafts and future-dated posts are not exported. Sequoia reads this export, not the source Markdown files.

One-time setup

The publication is initialized for jan0ski.net. Its URI is stored in sequoia.json and static/.well-known/site.standard.publication. Do not create another publication for this site.

1. Install dependencies with npm ci.
2. Run npx sequoia auth to sign in as jan0ski.net with an app password, or use npx sequoia login for OAuth. Never commit credentials or paste passwords into chat.
3. Set the ATPROTO_APP_PASSWORD repository secret in GitHub Actions secrets. The workflow passes it to Sequoia as ATP_APP_PASSWORD.

For local use in an Amp orb, the project secret is named ATP_APP_PASSWORD. Keep pathTemplate: "{path}", removeIndexFromSlug: true, textContentField: "textContent", and autoSync: false in sequoia.json.

Deployment

The Pages workflow builds Hugo, restores document IDs from the PDS with sequoia sync --update-frontmatter, publishes with sequoia publish --force, and adds verification links with sequoia inject. It then removes the temporary export and deploys the HTML. This order includes the verification links in the deployed artifact.

Sequoia state and generated atUri metadata stay in temporary build files; CI does not commit changes to posts. Each fresh build restores IDs by matching canonical paths on the PDS. Forced publishing ensures content edits reach the existing records after state recovery. Keep post URLs stable to retain their IDs. If a post is removed, made private, or moved, remove its old ATProto record separately.

Publishing is skipped on pull requests or when the repository secret is absent. Sequoia 0.5.7 can report per-post errors without a failing exit code, so the workflow also checks its error summary before deployment.

Local checks

Use Hugo 0.167.0 extended, Node.js 24, Python 3.11 or later, and the theme submodule:

git submodule update --init --recursive
npm ci
npm test
npm run build
npx sequoia publish --dry-run --verbose

The dry run needs an initialized configuration and Sequoia credentials, but does not write records. Tests use the real Sequoia CLI with local fixtures and no PDS access.

Dependency security

npm audit reports an upstream Zod memory-exhaustion advisory (GHSA-mrhx-c7xc-m3w5) through Sequoia's ATProto dependencies. Sequoia 0.5.7 has no compatible dependency fix. The CLI runs during publishing, not in the deployed website; this does not remove the dependency risk.