[{"data":1,"prerenderedAt":1879},["ShallowReactive",2],{"page:\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fsecuring-deploy-credentials-with-github-oidc":3,"all-docs-nav":1336},{"id":4,"title":5,"body":6,"breadcrumb":1312,"dateModified":1322,"datePublished":1322,"description":1323,"extension":1324,"faq":1325,"meta":1330,"navigation":92,"path":1331,"seo":1332,"slug":12,"stem":1333,"type":1334,"__hash__":1335},"content\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fsecuring-deploy-credentials-with-github-oidc\u002Findex.md","Securing Deploy Credentials with GitHub OIDC",{"type":7,"value":8,"toc":1294},"minimark",[9,13,17,26,31,44,48,51,331,337,499,503,510,643,661,737,744,748,751,792,896,959,963,966,1054,1130,1134,1144,1148,1162,1166,1209,1213,1216,1220,1225,1228,1232,1235,1239,1242,1246,1249,1253,1290],[10,11,5],"h1",{"id":12},"securing-deploy-credentials-with-github-oidc",[14,15,16],"p",{},"Most static sites deploy with a token stored as a CI secret: an AWS access key, a Cloudflare API token, a Netlify personal access token. It sits in the repository settings for years, it is available to every job that references it, and anyone who obtains it — through a leaked log, a compromised dependency, a malicious workflow change — can publish anything to the site until someone notices and rotates it. For a static site, where the deploy token is effectively the key to every page, that is the single most valuable secret the organisation holds for it.",[14,18,19,20,25],{},"OpenID Connect (OIDC) removes the stored secret. Each workflow run requests a signed identity token from GitHub that says which repository, branch, environment and workflow it is; the cloud provider checks that identity against a trust policy and returns credentials valid for minutes. Nothing long-lived exists to leak. This guide sets that up for AWS, and for hosts that only accept API tokens, shows how to get most of the same protection. It is part of ",[21,22,24],"a",{"href":23},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002F","Security Headers and Hardening for Static Sites",".",[27,28,30],"h2",{"id":29},"prerequisites","Prerequisites",[32,33,34,38,41],"ul",{},[35,36,37],"li",{},"A static site deployed from GitHub Actions.",[35,39,40],{},"Admin access to the repository (for environments and branch protection) and to the hosting account.",[35,42,43],{},"A deploy that can run as its own job, separate from install and build.",[27,45,47],{"id":46},"step-1-split-build-and-deploy","Step 1: Split Build and Deploy",[14,49,50],{},"Before touching credentials, separate the job that runs third-party code from the job that holds the credential. The build job installs dependencies and builds; it uploads the output as an artifact and has no deploy permissions. The deploy job downloads the artifact and publishes it; it installs nothing.",[52,53,58],"pre",{"className":54,"code":55,"language":56,"meta":57,"style":57},"language-yaml shiki shiki-themes github-light github-dark","permissions: { contents: read }\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - run: npm ci --ignore-scripts && npm rebuild sharp && npm run build\n      - uses: actions\u002Fupload-artifact@v4\n        with: { name: site, path: dist\u002F }\n\n  deploy:\n    needs: build\n    if: github.ref == 'refs\u002Fheads\u002Fmain'\n    runs-on: ubuntu-latest\n    environment: production          # protected environment, required reviewers optional\n    permissions: { id-token: write, contents: read }\n    steps:\n      - uses: actions\u002Fdownload-artifact@v4\n        with: { name: site, path: dist\u002F }\n      # credential steps below\n","yaml","",[59,60,61,87,94,103,111,122,130,144,157,169,198,203,211,222,233,242,257,283,290,302,325],"code",{"__ignoreMap":57},[62,63,66,70,74,77,80,84],"span",{"class":64,"line":65},"line",1,[62,67,69],{"class":68},"s9eBZ","permissions",[62,71,73],{"class":72},"sVt8B",": { ",[62,75,76],{"class":68},"contents",[62,78,79],{"class":72},": ",[62,81,83],{"class":82},"sZZnC","read",[62,85,86],{"class":72}," }\n",[62,88,90],{"class":64,"line":89},2,[62,91,93],{"emptyLinePlaceholder":92},true,"\n",[62,95,97,100],{"class":64,"line":96},3,[62,98,99],{"class":68},"jobs",[62,101,102],{"class":72},":\n",[62,104,106,109],{"class":64,"line":105},4,[62,107,108],{"class":68},"  build",[62,110,102],{"class":72},[62,112,114,117,119],{"class":64,"line":113},5,[62,115,116],{"class":68},"    runs-on",[62,118,79],{"class":72},[62,120,121],{"class":82},"ubuntu-latest\n",[62,123,125,128],{"class":64,"line":124},6,[62,126,127],{"class":68},"    steps",[62,129,102],{"class":72},[62,131,133,136,139,141],{"class":64,"line":132},7,[62,134,135],{"class":72},"      - ",[62,137,138],{"class":68},"uses",[62,140,79],{"class":72},[62,142,143],{"class":82},"actions\u002Fcheckout@v4\n",[62,145,147,149,152,154],{"class":64,"line":146},8,[62,148,135],{"class":72},[62,150,151],{"class":68},"run",[62,153,79],{"class":72},[62,155,156],{"class":82},"npm ci --ignore-scripts && npm rebuild sharp && npm run build\n",[62,158,160,162,164,166],{"class":64,"line":159},9,[62,161,135],{"class":72},[62,163,138],{"class":68},[62,165,79],{"class":72},[62,167,168],{"class":82},"actions\u002Fupload-artifact@v4\n",[62,170,172,175,177,180,182,185,188,191,193,196],{"class":64,"line":171},10,[62,173,174],{"class":68},"        with",[62,176,73],{"class":72},[62,178,179],{"class":68},"name",[62,181,79],{"class":72},[62,183,184],{"class":82},"site",[62,186,187],{"class":72},", ",[62,189,190],{"class":68},"path",[62,192,79],{"class":72},[62,194,195],{"class":82},"dist\u002F",[62,197,86],{"class":72},[62,199,201],{"class":64,"line":200},11,[62,202,93],{"emptyLinePlaceholder":92},[62,204,206,209],{"class":64,"line":205},12,[62,207,208],{"class":68},"  deploy",[62,210,102],{"class":72},[62,212,214,217,219],{"class":64,"line":213},13,[62,215,216],{"class":68},"    needs",[62,218,79],{"class":72},[62,220,221],{"class":82},"build\n",[62,223,225,228,230],{"class":64,"line":224},14,[62,226,227],{"class":68},"    if",[62,229,79],{"class":72},[62,231,232],{"class":82},"github.ref == 'refs\u002Fheads\u002Fmain'\n",[62,234,236,238,240],{"class":64,"line":235},15,[62,237,116],{"class":68},[62,239,79],{"class":72},[62,241,121],{"class":82},[62,243,245,248,250,253],{"class":64,"line":244},16,[62,246,247],{"class":68},"    environment",[62,249,79],{"class":72},[62,251,252],{"class":82},"production",[62,254,256],{"class":255},"sJ8bj","          # protected environment, required reviewers optional\n",[62,258,260,263,265,268,270,273,275,277,279,281],{"class":64,"line":259},17,[62,261,262],{"class":68},"    permissions",[62,264,73],{"class":72},[62,266,267],{"class":68},"id-token",[62,269,79],{"class":72},[62,271,272],{"class":82},"write",[62,274,187],{"class":72},[62,276,76],{"class":68},[62,278,79],{"class":72},[62,280,83],{"class":82},[62,282,86],{"class":72},[62,284,286,288],{"class":64,"line":285},18,[62,287,127],{"class":68},[62,289,102],{"class":72},[62,291,293,295,297,299],{"class":64,"line":292},19,[62,294,135],{"class":72},[62,296,138],{"class":68},[62,298,79],{"class":72},[62,300,301],{"class":82},"actions\u002Fdownload-artifact@v4\n",[62,303,305,307,309,311,313,315,317,319,321,323],{"class":64,"line":304},20,[62,306,174],{"class":68},[62,308,73],{"class":72},[62,310,179],{"class":68},[62,312,79],{"class":72},[62,314,184],{"class":82},[62,316,187],{"class":72},[62,318,190],{"class":68},[62,320,79],{"class":72},[62,322,195],{"class":82},[62,324,86],{"class":72},[62,326,328],{"class":64,"line":327},21,[62,329,330],{"class":255},"      # credential steps below\n",[14,332,333,336],{},[59,334,335],{},"id-token: write"," is granted only to the deploy job, so only it can request an OIDC token. A compromised package in the build job cannot mint credentials because its job has no permission to ask.",[338,339,340,495],"figure",{},[341,342,349,350,349,354,349,358,349,365,349,480],"svg",{"viewBox":343,"role":344,"ariaLabelledBy":345,"xmlns":348},"0 0 760 290","img",[346,347],"oidc-flow-title","oidc-flow-desc","http:\u002F\u002Fwww.w3.org\u002F2000\u002Fsvg","\n  ",[351,352,353],"title",{"id":346},"OIDC credential exchange during a deploy",[355,356,357],"desc",{"id":347},"The deploy job asks GitHub for an identity token stating repository, branch main and environment production. It presents that token to the cloud provider's security token service. The provider checks the token against a trust policy that only accepts this repository's production environment, and returns credentials valid for 15 minutes. The job uploads the site, and the credentials expire shortly afterwards.",[359,360],"rect",{"x":361,"y":361,"width":362,"height":363,"fill":364},"0","760","290","#ffffff",[366,367,369,370,369,378,369,387,369,393,369,398,369,403,369,407,369,411,369,417,369,421,369,424,369,431,369,435,369,440,369,458,369,462,369,465,369,471,369,476,349],"g",{"style":368},"font-family:system-ui, sans-serif;font-size:12px","\n    ",[371,372,377],"text",{"x":373,"y":374,"fill":375,"style":376},"380","28","#1f2937","font-size:16px;font-weight:700;text-anchor:middle","Identity in, short-lived credential out",[359,379],{"x":380,"y":381,"width":382,"height":381,"rx":383,"fill":384,"opacity":385,"stroke":384,"style":386},"30","70","170","10","#6a4c93","0.14","stroke-width:1.5px",[371,388,392],{"x":389,"y":390,"fill":375,"style":391},"115","96","font-weight:700;text-anchor:middle","deploy job",[371,394,335],{"x":389,"y":395,"fill":396,"style":397},"116","#556071","font-size:11px;text-anchor:middle",[359,399],{"x":380,"y":400,"width":382,"height":381,"rx":383,"fill":401,"stroke":402,"style":386},"180","#f8fafc","#d9e2ef",[371,404,406],{"x":389,"y":405,"fill":375,"style":391},"206","GitHub OIDC",[371,408,410],{"x":389,"y":409,"fill":396,"style":397},"226","signs repo, ref, env",[359,412],{"x":363,"y":381,"width":413,"height":381,"rx":383,"fill":414,"opacity":415,"stroke":416,"style":386},"200","#ffca3a","0.22","#a97b00",[371,418,420],{"x":419,"y":390,"fill":375,"style":391},"390","provider STS",[371,422,423],{"x":419,"y":395,"fill":396,"style":397},"check trust policy",[359,425],{"x":426,"y":381,"width":427,"height":381,"rx":383,"fill":428,"opacity":429,"stroke":430,"style":386},"570","160","#8ac926","0.2","#5a8a16",[371,432,434],{"x":433,"y":390,"fill":375,"style":391},"650","credential",[371,436,439],{"x":433,"y":395,"fill":437,"style":438},"#3f6410","font-size:11px;font-weight:700;text-anchor:middle","expires in 15 min",[366,441,444,445,444,449,444,452,444,455,369],{"stroke":396,"fill":442,"style":443},"none","stroke-width:2px","\n      ",[190,446],{"d":447,"style":448},"M100 142 L100 176","marker-end:url(#oidc-arrow)",[190,450],{"d":451,"style":448},"M130 178 L130 144",[190,453],{"d":454,"style":448},"M202 105 L286 105",[190,456],{"d":457,"style":448},"M492 105 L566 105",[371,459,461],{"x":460,"y":390,"fill":396,"style":397},"244","JWT",[359,463],{"x":363,"y":400,"width":464,"height":381,"rx":383,"fill":401,"stroke":402,"style":386},"440",[371,466,470],{"x":467,"y":468,"fill":375,"style":469},"310","204","font-size:11px","trust policy accepts only:",[371,472,475],{"x":467,"y":473,"fill":375,"style":474},"224","font-size:11px;font-family:ui-monospace, monospace","repo:acme\u002Fdocs:environment:production",[371,477,479],{"x":467,"y":478,"fill":396,"style":469},"242","forks, other branches, other repos: rejected",[481,482,369,483,349],"defs",{},[484,485,444,492,369],"marker",{"id":486,"viewBox":487,"refX":488,"refY":489,"markerWidth":490,"markerHeight":490,"orient":491},"oidc-arrow","0 0 10 10","8","5","7","auto-start-reverse",[190,493],{"d":494,"fill":396},"M0 0 L10 5 L0 10 z",[496,497,498],"figcaption",{},"The only thing stored anywhere is the trust policy, which grants nothing on its own.",[27,500,502],{"id":501},"step-2-aws-s3-and-cloudfront","Step 2: AWS (S3 and CloudFront)",[14,504,505,506,509],{},"Create an IAM OIDC identity provider for ",[59,507,508],{},"token.actions.githubusercontent.com"," once per account, then a role whose trust policy accepts only your repository's production environment:",[52,511,515],{"className":512,"code":513,"language":514,"meta":57,"style":57},"language-json shiki shiki-themes github-light github-dark","{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Effect\": \"Allow\",\n    \"Principal\": { \"Federated\": \"arn:aws:iam::123456789012:oidc-provider\u002Ftoken.actions.githubusercontent.com\" },\n    \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n    \"Condition\": {\n      \"StringEquals\": {\n        \"token.actions.githubusercontent.com:aud\": \"sts.amazonaws.com\",\n        \"token.actions.githubusercontent.com:sub\": \"repo:acme\u002Fdocs:environment:production\"\n      }\n    }\n  }]\n}\n","json",[59,516,517,522,536,544,556,574,586,594,601,613,623,628,633,638],{"__ignoreMap":57},[62,518,519],{"class":64,"line":65},[62,520,521],{"class":72},"{\n",[62,523,524,528,530,533],{"class":64,"line":89},[62,525,527],{"class":526},"sj4cs","  \"Version\"",[62,529,79],{"class":72},[62,531,532],{"class":82},"\"2012-10-17\"",[62,534,535],{"class":72},",\n",[62,537,538,541],{"class":64,"line":96},[62,539,540],{"class":526},"  \"Statement\"",[62,542,543],{"class":72},": [{\n",[62,545,546,549,551,554],{"class":64,"line":105},[62,547,548],{"class":526},"    \"Effect\"",[62,550,79],{"class":72},[62,552,553],{"class":82},"\"Allow\"",[62,555,535],{"class":72},[62,557,558,561,563,566,568,571],{"class":64,"line":113},[62,559,560],{"class":526},"    \"Principal\"",[62,562,73],{"class":72},[62,564,565],{"class":526},"\"Federated\"",[62,567,79],{"class":72},[62,569,570],{"class":82},"\"arn:aws:iam::123456789012:oidc-provider\u002Ftoken.actions.githubusercontent.com\"",[62,572,573],{"class":72}," },\n",[62,575,576,579,581,584],{"class":64,"line":124},[62,577,578],{"class":526},"    \"Action\"",[62,580,79],{"class":72},[62,582,583],{"class":82},"\"sts:AssumeRoleWithWebIdentity\"",[62,585,535],{"class":72},[62,587,588,591],{"class":64,"line":132},[62,589,590],{"class":526},"    \"Condition\"",[62,592,593],{"class":72},": {\n",[62,595,596,599],{"class":64,"line":146},[62,597,598],{"class":526},"      \"StringEquals\"",[62,600,593],{"class":72},[62,602,603,606,608,611],{"class":64,"line":159},[62,604,605],{"class":526},"        \"token.actions.githubusercontent.com:aud\"",[62,607,79],{"class":72},[62,609,610],{"class":82},"\"sts.amazonaws.com\"",[62,612,535],{"class":72},[62,614,615,618,620],{"class":64,"line":171},[62,616,617],{"class":526},"        \"token.actions.githubusercontent.com:sub\"",[62,619,79],{"class":72},[62,621,622],{"class":82},"\"repo:acme\u002Fdocs:environment:production\"\n",[62,624,625],{"class":64,"line":200},[62,626,627],{"class":72},"      }\n",[62,629,630],{"class":64,"line":205},[62,631,632],{"class":72},"    }\n",[62,634,635],{"class":64,"line":213},[62,636,637],{"class":72},"  }]\n",[62,639,640],{"class":64,"line":224},[62,641,642],{"class":72},"}\n",[14,644,645,646,187,649,652,653,656,657,660],{},"Attach a permissions policy that allows only ",[59,647,648],{},"s3:PutObject",[59,650,651],{},"s3:DeleteObject"," and ",[59,654,655],{},"s3:ListBucket"," on the site bucket and ",[59,658,659],{},"cloudfront:CreateInvalidation"," on its distribution. Then, in the deploy job:",[52,662,664],{"className":54,"code":663,"language":56,"meta":57,"style":57},"- uses: aws-actions\u002Fconfigure-aws-credentials@v4\n  with:\n    role-to-assume: arn:aws:iam::123456789012:role\u002Fdocs-deploy\n    aws-region: eu-west-1\n    role-duration-seconds: 900\n- run: aws s3 sync dist\u002F s3:\u002F\u002Fdocs-example-com\u002F --delete\n- run: aws cloudfront create-invalidation --distribution-id E2ABC123 --paths '\u002F*'\n",[59,665,666,678,685,695,705,715,726],{"__ignoreMap":57},[62,667,668,671,673,675],{"class":64,"line":65},[62,669,670],{"class":72},"- ",[62,672,138],{"class":68},[62,674,79],{"class":72},[62,676,677],{"class":82},"aws-actions\u002Fconfigure-aws-credentials@v4\n",[62,679,680,683],{"class":64,"line":89},[62,681,682],{"class":68},"  with",[62,684,102],{"class":72},[62,686,687,690,692],{"class":64,"line":96},[62,688,689],{"class":68},"    role-to-assume",[62,691,79],{"class":72},[62,693,694],{"class":82},"arn:aws:iam::123456789012:role\u002Fdocs-deploy\n",[62,696,697,700,702],{"class":64,"line":105},[62,698,699],{"class":68},"    aws-region",[62,701,79],{"class":72},[62,703,704],{"class":82},"eu-west-1\n",[62,706,707,710,712],{"class":64,"line":113},[62,708,709],{"class":68},"    role-duration-seconds",[62,711,79],{"class":72},[62,713,714],{"class":526},"900\n",[62,716,717,719,721,723],{"class":64,"line":124},[62,718,670],{"class":72},[62,720,151],{"class":68},[62,722,79],{"class":72},[62,724,725],{"class":82},"aws s3 sync dist\u002F s3:\u002F\u002Fdocs-example-com\u002F --delete\n",[62,727,728,730,732,734],{"class":64,"line":132},[62,729,670],{"class":72},[62,731,151],{"class":68},[62,733,79],{"class":72},[62,735,736],{"class":82},"aws cloudfront create-invalidation --distribution-id E2ABC123 --paths '\u002F*'\n",[14,738,739,740,25],{},"The full S3 deploy is described in ",[21,741,743],{"href":742},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fdeploying-a-static-site-to-s3-and-cloudfront\u002F","Deploying a Static Site to S3 and CloudFront",[27,745,747],{"id":746},"step-3-hosts-without-native-oidc","Step 3: Hosts Without Native OIDC",[14,749,750],{},"Cloudflare Pages and Workers, Netlify and Vercel deploy with API tokens rather than federated identity. You can still get most of the benefit:",[32,752,753,760,774,780,786],{},[35,754,755,759],{},[756,757,758],"strong",{},"Scope the token narrowly."," A Cloudflare API token can be limited to \"Cloudflare Pages: Edit\" (or \"Workers Scripts: Edit\") on one account and nothing else. It cannot touch DNS, other zones or billing.",[35,761,762,765,766,769,770,773],{},[756,763,764],{},"Store it in a protected environment, not a repository secret."," GitHub environment secrets are only available to jobs that declare ",[59,767,768],{},"environment: production",", and the environment can require the ",[59,771,772],{},"main"," branch and optional reviewer approval. A workflow edited in a pull request cannot read it.",[35,775,776,779],{},[756,777,778],{},"Keep it out of the build job."," Only the deploy job references the environment.",[35,781,782,785],{},[756,783,784],{},"Rotate on a schedule."," Set an expiry on the token (Cloudflare supports this at creation) and rotate quarterly.",[35,787,788,791],{},[756,789,790],{},"Broker for the strictest setups."," A small Worker can accept a GitHub OIDC token, verify its signature and claims against GitHub's published keys, and use a securely stored master token to create a short-lived, single-purpose token for this run. Most teams find the environment-scoped token sufficient.",[52,793,795],{"className":54,"code":794,"language":56,"meta":57,"style":57},"deploy:\n  environment: production\n  steps:\n    - uses: actions\u002Fdownload-artifact@v4\n      with: { name: site, path: dist\u002F }\n    - run: npx wrangler@3 deploy\n      env:\n        CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PAGES_DEPLOY_TOKEN }}   # environment secret\n        CLOUDFLARE_ACCOUNT_ID: ${{ vars.CF_ACCOUNT_ID }}\n",[59,796,797,804,814,821,832,855,866,873,886],{"__ignoreMap":57},[62,798,799,802],{"class":64,"line":65},[62,800,801],{"class":68},"deploy",[62,803,102],{"class":72},[62,805,806,809,811],{"class":64,"line":89},[62,807,808],{"class":68},"  environment",[62,810,79],{"class":72},[62,812,813],{"class":82},"production\n",[62,815,816,819],{"class":64,"line":96},[62,817,818],{"class":68},"  steps",[62,820,102],{"class":72},[62,822,823,826,828,830],{"class":64,"line":105},[62,824,825],{"class":72},"    - ",[62,827,138],{"class":68},[62,829,79],{"class":72},[62,831,301],{"class":82},[62,833,834,837,839,841,843,845,847,849,851,853],{"class":64,"line":113},[62,835,836],{"class":68},"      with",[62,838,73],{"class":72},[62,840,179],{"class":68},[62,842,79],{"class":72},[62,844,184],{"class":82},[62,846,187],{"class":72},[62,848,190],{"class":68},[62,850,79],{"class":72},[62,852,195],{"class":82},[62,854,86],{"class":72},[62,856,857,859,861,863],{"class":64,"line":124},[62,858,825],{"class":72},[62,860,151],{"class":68},[62,862,79],{"class":72},[62,864,865],{"class":82},"npx wrangler@3 deploy\n",[62,867,868,871],{"class":64,"line":132},[62,869,870],{"class":68},"      env",[62,872,102],{"class":72},[62,874,875,878,880,883],{"class":64,"line":146},[62,876,877],{"class":68},"        CLOUDFLARE_API_TOKEN",[62,879,79],{"class":72},[62,881,882],{"class":82},"${{ secrets.CF_PAGES_DEPLOY_TOKEN }}",[62,884,885],{"class":255},"   # environment secret\n",[62,887,888,891,893],{"class":64,"line":159},[62,889,890],{"class":68},"        CLOUDFLARE_ACCOUNT_ID",[62,892,79],{"class":72},[62,894,895],{"class":82},"${{ vars.CF_ACCOUNT_ID }}\n",[338,897,898,956],{},[341,899,349,904,349,907,349,910,349,913],{"viewBox":900,"role":344,"ariaLabelledBy":901,"xmlns":348},"0 0 760 250",[902,903],"oidc-host-title","oidc-host-desc",[351,905,906],{"id":902},"Credential options by host",[355,908,909],{"id":903},"A ladder of three options from strongest to weakest. Native OIDC federation, available on AWS, Google Cloud and Azure, stores nothing. An OIDC broker issuing per-run host tokens stores one master token outside CI. An environment-scoped, narrowly permissioned API token stored as a protected environment secret is the practical minimum for Cloudflare, Netlify and Vercel.",[359,911],{"x":361,"y":361,"width":362,"height":912,"fill":364},"250",[366,914,369,915,369,918,369,924,369,930,369,935,369,938,369,942,369,945,369,950,369,953,349],{"style":368},[371,916,917],{"x":373,"y":374,"fill":375,"style":376},"Use the strongest option your host supports",[359,919],{"x":920,"y":921,"width":922,"height":921,"rx":383,"fill":428,"opacity":923,"stroke":430,"style":386},"40","50","680","0.18",[371,925,929],{"x":926,"y":927,"fill":375,"style":928},"60","80","font-weight:700","native OIDC federation",[371,931,934],{"x":932,"y":927,"fill":396,"style":933},"700","font-size:11px;text-anchor:end","AWS · GCP · Azure — nothing stored in CI",[359,936],{"x":920,"y":937,"width":922,"height":921,"rx":383,"fill":414,"opacity":415,"stroke":416,"style":386},"112",[371,939,941],{"x":926,"y":940,"fill":375,"style":928},"142","OIDC broker → per-run token",[371,943,944],{"x":932,"y":940,"fill":396,"style":933},"any API-token host — master token lives outside CI",[359,946],{"x":920,"y":947,"width":922,"height":921,"rx":383,"fill":948,"opacity":949,"stroke":948,"style":386},"174","#1982c4","0.12",[371,951,952],{"x":926,"y":468,"fill":375,"style":928},"scoped token in protected environment",[371,954,955],{"x":932,"y":468,"fill":396,"style":933},"Cloudflare · Netlify · Vercel — practical minimum",[496,957,958],{},"Even the bottom rung is a large improvement on a broad, repository-wide token readable by every job.",[27,960,962],{"id":961},"measured-impact","Measured Impact",[14,964,965],{},"The documentation site's credential exposure before and after the change:",[967,968,969,985],"table",{},[970,971,972],"thead",{},[973,974,975,979,982],"tr",{},[976,977,978],"th",{},"Measure",[976,980,981],{},"Before",[976,983,984],{},"After",[986,987,988,1000,1011,1021,1032,1043],"tbody",{},[973,989,990,994,997],{},[991,992,993],"td",{},"Long-lived deploy credentials stored in GitHub",[991,995,996],{},"2 (AWS key, Cloudflare token)",[991,998,999],{},"0 for AWS; 1 environment-scoped Cloudflare token",[973,1001,1002,1005,1008],{},[991,1003,1004],{},"Jobs with access to deploy credentials",[991,1006,1007],{},"3 (build, test, deploy)",[991,1009,1010],{},"1 (deploy)",[973,1012,1013,1016,1019],{},[991,1014,1015],{},"Steps that run third-party code with credentials present",[991,1017,1018],{},"~900 package scripts + build",[991,1020,361],{},[973,1022,1023,1026,1029],{},[991,1024,1025],{},"Credential lifetime (AWS)",[991,1027,1028],{},"indefinite (key age 26 months)",[991,1030,1031],{},"15 minutes",[973,1033,1034,1037,1040],{},[991,1035,1036],{},"Fork pull requests able to request credentials",[991,1038,1039],{},"not tested",[991,1041,1042],{},"rejected by trust policy",[973,1044,1045,1048,1051],{},[991,1046,1047],{},"Deploy time change",[991,1049,1050],{},"—",[991,1052,1053],{},"+4 s (artifact upload\u002Fdownload)",[338,1055,1056,1127],{},[341,1057,349,1062,349,1065,349,1068,349,1071],{"viewBox":1058,"role":344,"ariaLabelledBy":1059,"xmlns":348},"0 0 760 260",[1060,1061],"oidc-exp-title","oidc-exp-desc",[351,1063,1064],{"id":1060},"Credential exposure window",[355,1066,1067],{"id":1061},"Two timelines. Before, an AWS access key existed continuously for 26 months and was present in every job of every run. After, a credential exists for 15 minutes during each deploy job only, a few minutes a day in total.",[359,1069],{"x":361,"y":361,"width":362,"height":1070,"fill":364},"260",[366,1072,369,1073,369,1076,369,1080,369,1089,369,1095,369,1099,369,1102,369,1108,369,1111,369,1114,369,1117,369,1120,369,1123,349],{"style":368},[371,1074,1075],{"x":373,"y":374,"fill":375,"style":376},"How long a stolen credential would have worked",[371,1077,1079],{"x":380,"y":1078,"fill":375,"style":928},"84","Stored key",[359,1081],{"x":1082,"y":1083,"width":426,"height":374,"rx":1084,"fill":1085,"opacity":1086,"stroke":1087,"style":1088},"150","66","4","#ff595e","0.28","#d83b41","stroke-width:1px",[371,1090,1094],{"x":1091,"y":1092,"fill":375,"style":1093},"435","85","text-anchor:middle","valid continuously · 26 months and counting",[371,1096,1098],{"x":380,"y":1097,"fill":375,"style":928},"154","OIDC",[64,1100],{"x1":1082,"y1":1082,"x2":1101,"y2":1082,"stroke":402,"style":443},"720",[359,1103],{"x":1104,"y":1105,"width":1106,"height":1107,"fill":428,"stroke":430,"style":1088},"190","138","6","24",[359,1109],{"x":1110,"y":1105,"width":1106,"height":1107,"fill":428,"stroke":430,"style":1088},"300",[359,1112],{"x":1113,"y":1105,"width":1106,"height":1107,"fill":428,"stroke":430,"style":1088},"420",[359,1115],{"x":1116,"y":1105,"width":1106,"height":1107,"fill":428,"stroke":430,"style":1088},"560",[359,1118],{"x":1119,"y":1105,"width":1106,"height":1107,"fill":428,"stroke":430,"style":1088},"660",[371,1121,1122],{"x":1091,"y":1104,"fill":437,"style":391},"15-minute windows, deploy job only",[371,1124,1126],{"x":373,"y":1125,"fill":396,"style":397},"236","A leaked OIDC credential is useless minutes later; a leaked stored key works until someone notices",[496,1128,1129],{},"Rotation policies try to shrink the red bar; OIDC replaces it with the green slivers.",[27,1131,1133],{"id":1132},"testing-the-trust-policy","Testing the Trust Policy",[14,1135,1136,1137,1140,1141,1143],{},"A trust policy is security-critical configuration and should be tested like code. Two negative tests are enough to catch the common mistakes. Open a pull request from a fork that adds a step calling ",[59,1138,1139],{},"configure-aws-credentials"," with the production role: it must fail with an access-denied error from STS. Then push a branch other than ",[59,1142,772],{}," in the main repository with the same step: that must fail too, because its subject claim names the branch rather than the production environment. Record both results in the pull request that introduced the policy, and repeat them whenever the policy changes. A policy that has only ever been tested by succeeding has not really been tested.",[27,1145,1147],{"id":1146},"auditing-who-deployed-what","Auditing Who Deployed What",[14,1149,1150,1151,1153,1154,1157,1158,25],{},"Short-lived credentials also improve the audit trail. Each AWS session created through OIDC records the role session name, which ",[59,1152,1139],{}," sets to include the workflow run ID; CloudTrail entries for every S3 write therefore link back to a specific GitHub Actions run, commit and actor. With a stored key, every deploy for two years had appeared in CloudTrail as the same anonymous IAM user. Add the run URL to the deploy's output — or to a ",[59,1155,1156],{},"deploy.json"," file written into the site itself — and any page in production can be traced to the exact workflow run that published it, which is the first question in any investigation described in ",[21,1159,1161],{"href":1160},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Frolling-back-a-bad-static-deploy-in-under-a-minute\u002F","Rolling Back a Bad Static Deploy in Under a Minute",[27,1163,1165],{"id":1164},"pitfalls-rollback","Pitfalls & Rollback",[32,1167,1168,1182,1191,1197,1203],{},[35,1169,1170,1173,1174,1177,1178,1181],{},[756,1171,1172],{},"Trusting the whole repository."," A ",[59,1175,1176],{},"sub"," condition of ",[59,1179,1180],{},"repo:acme\u002Fdocs:*"," lets any branch or pull request workflow assume the role. Pin it to the environment or branch.",[35,1183,1184,1190],{},[756,1185,1186,1187,1189],{},"Granting ",[59,1188,335],{}," at workflow level."," Give it only to the deploy job, or the build job can request tokens too.",[35,1192,1193,1196],{},[756,1194,1195],{},"Broad permissions on the role."," The role should be able to write one bucket and invalidate one distribution, nothing else.",[35,1198,1199,1202],{},[756,1200,1201],{},"Forgetting preview deploys."," Preview jobs need their own role or token with access only to preview targets, never production.",[35,1204,1205,1208],{},[756,1206,1207],{},"Rollback:"," keep the old secret disabled but present for one release cycle; re-enabling it restores the previous deploy path if the OIDC setup fails. Delete it once the new path has deployed cleanly for a week.",[27,1210,1212],{"id":1211},"conclusion","Conclusion",[14,1214,1215],{},"The deploy credential is the most powerful secret a static site has, and the easiest to eliminate. Splitting build from deploy removes third-party code from the credential's reach; OIDC removes the stored credential altogether where the host supports it; environment-scoped, narrowly permissioned tokens cover the hosts that do not. On this site that took two stored keys down to one tightly scoped token, cut AWS credential lifetime from 26 months to 15 minutes, and cost four seconds per deploy.",[27,1217,1219],{"id":1218},"faq","FAQ",[1221,1222,1224],"h3",{"id":1223},"what-is-oidc-in-github-actions","What is OIDC in GitHub Actions?",[14,1226,1227],{},"GitHub can issue a signed identity token to a workflow run that states which repository, branch, environment and workflow it is. A cloud provider configured to trust GitHub exchanges that token for short-lived credentials, so no long-lived secret is stored anywhere.",[1221,1229,1231],{"id":1230},"which-hosts-support-oidc-deploys","Which hosts support OIDC deploys?",[14,1233,1234],{},"AWS, Google Cloud and Azure support it natively. For hosts that only accept API tokens, such as Cloudflare or Netlify, you can keep a narrowly scoped token in a protected environment or exchange the OIDC token through a small broker that issues short-lived host tokens.",[1221,1236,1238],{"id":1237},"how-long-do-oidc-credentials-last","How long do OIDC credentials last?",[14,1240,1241],{},"As long as you configure, typically 15 minutes to one hour. A deploy of a static site takes a minute or two, so the shortest duration the provider allows is usually enough.",[1221,1243,1245],{"id":1244},"what-stops-a-pull-request-from-a-fork-using-the-credential","What stops a pull request from a fork using the credential?",[14,1247,1248],{},"The trust policy. It should accept only tokens whose subject claim names your repository and the protected branch or environment, which fork pull requests cannot produce.",[27,1250,1252],{"id":1251},"related","Related",[32,1254,1255,1264,1271,1278,1283],{},[35,1256,1257,1260,1261,1263],{},[756,1258,1259],{},"Parent:"," ",[21,1262,24],{"href":23}," — pipeline and edge hardening together.",[35,1265,1266,1270],{},[21,1267,1269],{"href":1268},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fauditing-npm-dependencies-in-ssg-pipelines\u002F","Auditing npm Dependencies in SSG Pipelines"," — why the build job must not hold credentials.",[35,1272,1273,1277],{},[21,1274,1276],{"href":1275},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fdeploying-to-multiple-environments-from-one-workflow\u002F","Deploying to Multiple Environments from One Workflow"," — environment-per-target setups.",[35,1279,1280,1282],{},[21,1281,743],{"href":742}," — the AWS side of this deploy.",[35,1284,1285,1289],{},[21,1286,1288],{"href":1287},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fautomating-preview-deploy-pipelines-with-github-actions\u002F","Automating Preview Deploy Pipelines with GitHub Actions"," — scoping preview credentials separately.",[1291,1292,1293],"style",{},"html pre.shiki code .s9eBZ, html code.shiki .s9eBZ{--shiki-default:#22863A;--shiki-dark:#85E89D}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":57,"searchDepth":89,"depth":89,"links":1295},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305,1311],{"id":29,"depth":89,"text":30},{"id":46,"depth":89,"text":47},{"id":501,"depth":89,"text":502},{"id":746,"depth":89,"text":747},{"id":961,"depth":89,"text":962},{"id":1132,"depth":89,"text":1133},{"id":1146,"depth":89,"text":1147},{"id":1164,"depth":89,"text":1165},{"id":1211,"depth":89,"text":1212},{"id":1218,"depth":89,"text":1219,"children":1306},[1307,1308,1309,1310],{"id":1223,"depth":96,"text":1224},{"id":1230,"depth":96,"text":1231},{"id":1237,"depth":96,"text":1238},{"id":1244,"depth":96,"text":1245},{"id":1251,"depth":89,"text":1252},[1313,1316,1319,1320],{"name":1314,"item":1315},"Home","\u002F",{"name":1317,"item":1318},"Production-Ready Deployment & CI\u002FCD Workflows","\u002Fproduction-ready-deployment-cicd-workflows\u002F",{"name":24,"item":23},{"name":5,"item":1321},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fsecuring-deploy-credentials-with-github-oidc\u002F","2026-09-18","Replace long-lived deploy tokens with short-lived OIDC credentials in GitHub Actions for AWS, Cloudflare and Netlify, scoped to one branch and one deploy job.","md",[1326,1327,1328,1329],{"q":1224,"a":1227},{"q":1231,"a":1234},{"q":1238,"a":1241},{"q":1245,"a":1248},{},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fsecuring-deploy-credentials-with-github-oidc",{"title":5,"description":1323},"production-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fsecuring-deploy-credentials-with-github-oidc\u002Findex","article","NVB37ZAZ5AKJQy6NEfOa5djS3QrPWZael_55s_v_8ho",[1337,1340,1343,1346,1349,1352,1355,1358,1361,1364,1367,1370,1373,1376,1379,1382,1385,1388,1391,1394,1397,1400,1403,1406,1409,1412,1415,1418,1421,1424,1427,1430,1433,1436,1439,1442,1445,1448,1451,1454,1457,1460,1463,1466,1469,1472,1475,1478,1481,1484,1487,1490,1493,1496,1499,1502,1505,1508,1511,1514,1517,1520,1523,1526,1529,1532,1535,1538,1541,1544,1547,1550,1553,1556,1559,1562,1565,1568,1571,1574,1577,1580,1583,1586,1589,1592,1595,1598,1601,1604,1607,1610,1613,1616,1619,1622,1625,1628,1631,1634,1637,1640,1643,1646,1649,1652,1655,1658,1661,1664,1667,1670,1673,1676,1679,1682,1685,1688,1691,1694,1697,1700,1703,1706,1709,1712,1715,1718,1721,1724,1727,1730,1733,1736,1739,1742,1745,1748,1751,1754,1757,1760,1763,1766,1769,1772,1775,1778,1781,1784,1787,1790,1792,1795,1798,1801,1804,1807,1810,1813,1816,1819,1821,1824,1826,1829,1832,1834,1835,1838,1841,1844,1847,1849,1852,1855,1858,1861,1864,1867,1870,1873,1876],{"path":1338,"title":1339},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fastro-vs-eleventy-build-times-at-10000-pages","Astro vs Eleventy Build Times at 10,000 Pages",{"path":1341,"title":1342},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fchoosing-between-astro-and-eleventy-for-large-docs","Astro vs Eleventy for Large Docs (1000+ Pages)",{"path":1344,"title":1345},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fcontent-collections-vs-eleventy-data-cascade","Content Collections vs the Eleventy Data Cascade",{"path":1347,"title":1348},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites","Astro vs Eleventy for Documentation Sites",{"path":1350,"title":1351},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fshortcodes-vs-components-for-docs-authors","Shortcodes vs Components for Docs Authors",{"path":1353,"title":1354},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fsidebar-navigation-in-astro-and-eleventy","Sidebar Navigation in Astro and Eleventy",{"path":1356,"title":1357},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fcustomizing-starlight-without-forking-the-theme","Customizing Starlight Without Forking the Theme",{"path":1359,"title":1360},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fdocusaurus-vs-starlight-for-product-documentation","Docusaurus vs Starlight for Product Documentation",{"path":1362,"title":1363},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress","Docs Frameworks: Docusaurus, Starlight and VitePress",{"path":1365,"title":1366},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fmdx-vs-markdoc-for-docs-content","MDX vs Markdoc for Docs Content",{"path":1368,"title":1369},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fmigrating-from-mkdocs-to-starlight","Migrating from MkDocs to Starlight",{"path":1371,"title":1372},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fversioned-documentation-with-docusaurus","Versioned Documentation with Docusaurus",{"path":1374,"title":1375},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fvitepress-for-library-documentation","VitePress for Library Documentation",{"path":1377,"title":1378},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fhow-to-benchmark-hugo-vs-astro-build-speeds","How to Benchmark Hugo vs Astro Build Speeds",{"path":1380,"title":1381},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fhugo-partialcached-for-faster-builds","Hugo partialCached for Faster Builds",{"path":1383,"title":1384},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories","Hugo Build Times for Large Repositories",{"path":1386,"title":1387},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fprofiling-hugo-templates-with-template-metrics","Profiling Hugo Templates With Template Metrics",{"path":1389,"title":1390},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Freducing-hugo-memory-usage-on-ci-runners","Reducing Hugo Memory Usage on CI Runners",{"path":1392,"title":1393},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fspeeding-up-hugo-builds-with-render-hooks-and-caching","Speeding Up Hugo Builds with Render Hooks & Caching",{"path":1395,"title":1396},"\u002Fchoosing-the-right-static-site-generator-for-production","Choosing the Right Static Site Generator for Production",{"path":1398,"title":1399},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Feleventy-vs-jekyll-for-markdown-heavy-blogs","Eleventy vs Jekyll for Markdown-Heavy Blogs",{"path":1401,"title":1402},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem","Jekyll Plugin Ecosystem",{"path":1404,"title":1405},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Freplacing-jekyll-plugins-when-migrating-to-eleventy","Replacing Jekyll Plugins When Migrating to Eleventy",{"path":1407,"title":1408},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Frunning-jekyll-on-github-pages-without-plugins","Running Jekyll on GitHub Pages Without Plugins",{"path":1410,"title":1411},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Fspeeding-up-slow-jekyll-builds","Speeding Up Slow Jekyll Builds",{"path":1413,"title":1414},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Fupgrading-jekyll-and-ruby-versions-safely","Upgrading Jekyll and Ruby Versions Safely",{"path":1416,"title":1417},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fconverting-front-matter-at-scale-during-migration","Converting Front Matter at Scale During Migration",{"path":1419,"title":1420},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators","Migrating Between Static Site Generators",{"path":1422,"title":1423},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fkeeping-redirects-working-after-an-ssg-migration","Keeping Redirects Working After an SSG Migration",{"path":1425,"title":1426},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-a-docs-site-from-jekyll-to-hugo","Migrating a Docs Site From Jekyll to Hugo",{"path":1428,"title":1429},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-from-gatsby-to-astro","Migrating from Gatsby to Astro",{"path":1431,"title":1432},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-from-hugo-to-astro-without-breaking-urls","Migrating From Hugo to Astro Without Breaking URLs",{"path":1434,"title":1435},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-wordpress-to-a-static-site-generator","Migrating WordPress to a Static Site Generator",{"path":1437,"title":1438},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fporting-shortcodes-and-includes-between-generators","Porting Shortcodes and Includes Between Generators",{"path":1440,"title":1441},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fhandling-dynamic-routes-in-nextjs-static-export","Handling Dynamic Routes in Next.js Static Export",{"path":1443,"title":1444},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites","Next.js Static Export for Content Sites",{"path":1446,"title":1447},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fmigrating-from-gatsby-to-nextjs-static-export","Migrating from Gatsby to Next.js Static Export",{"path":1449,"title":1450},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fnextjs-app-router-static-export-limitations","Next.js App Router Static Export Limitations",{"path":1452,"title":1453},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fnextjs-static-export-vs-astro-for-marketing-sites","Next.js Static Export vs Astro for Marketing",{"path":1455,"title":1456},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Foptimizing-images-in-nextjs-static-export","Optimizing Images in Next.js Static Export",{"path":1458,"title":1459},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fadding-pagefind-to-an-astro-site","Adding Pagefind to an Astro Site",{"path":1461,"title":1462},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fbuilding-a-lunr-index-at-build-time-in-eleventy","Building a Lunr Index at Build Time in Eleventy",{"path":1464,"title":1465},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites","Search for Static Sites",{"path":1467,"title":1468},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Findexing-hugo-sites-with-pagefind","Indexing Hugo Sites with Pagefind",{"path":1470,"title":1471},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fmultilingual-search-on-static-sites","Multilingual Search on Static Sites",{"path":1473,"title":1474},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fpagefind-vs-algolia-docsearch","Pagefind vs Algolia DocSearch",{"path":1476,"title":1477},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fsearch-index-size-budgets-for-large-docs","Search Index Size Budgets for Large Docs",{"path":1479,"title":1480},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fbest-ssg-for-technical-writers-without-coding-experience","Best SSG for Non-Developer Technical Writers",{"path":1482,"title":1483},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fchoosing-an-ssg-for-api-reference-documentation","Choosing an SSG for API Reference Documentation",{"path":1485,"title":1486},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fevaluating-ssg-accessibility-defaults","Evaluating SSG Accessibility Defaults",{"path":1488,"title":1489},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix","SSG Framework Selection Matrix",{"path":1491,"title":1492},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fpicking-an-ssg-for-a-multi-language-documentation-site","Picking an SSG for a Multi-Language Docs Site",{"path":1494,"title":1495},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fssg-selection-checklist-for-engineering-teams","SSG Selection Checklist for Engineering Teams",{"path":1497,"title":1498},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Ftotal-cost-of-ownership-for-static-site-generators","Total Cost of Ownership for Static Site Generators",{"path":1500,"title":1501},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fcache-busting-with-content-hashed-filenames","Cache Busting with Content-Hashed Filenames",{"path":1503,"title":1504},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs","CDN Caching Rules for SSGs",{"path":1506,"title":1507},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fpurging-the-cdn-cache-after-a-static-deploy","Purging the CDN Cache After a Static Deploy",{"path":1509,"title":1510},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fsetting-cache-control-headers-on-cloudflare-pages","Cache-Control Headers on Cloudflare Pages",{"path":1512,"title":1513},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fsetting-up-proper-cache-headers-on-netlify","Proper Cache Headers on Netlify for SSGs",{"path":1515,"title":1516},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fstale-while-revalidate-for-static-html","Stale-While-Revalidate for Static HTML",{"path":1518,"title":1519},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Feliminating-layout-shift-from-web-fonts","Eliminating Layout Shift From Web Fonts",{"path":1521,"title":1522},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Ffixing-cls-from-cookie-banners","Fixing CLS from Cookie Banners",{"path":1524,"title":1525},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Ffixing-cls-from-late-loading-embeds","Fixing CLS From Late-Loading Embeds",{"path":1527,"title":1528},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Ffixing-cls-from-sticky-headers-and-anchor-links","Fixing CLS from Sticky Headers and Anchor Links",{"path":1530,"title":1531},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites","Cumulative Layout Shift Fixes for Static Sites",{"path":1533,"title":1534},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Fmeasuring-cls-in-the-field-with-web-vitals-js","Measuring CLS in the Field With web-vitals.js",{"path":1536,"title":1537},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Freserving-space-for-images-and-embeds-to-stop-layout-shift","Reserving Space for Images and Embeds",{"path":1539,"title":1540},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Ffont-display-optional-vs-swap","font-display: optional vs swap",{"path":1542,"title":1543},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites","Font Loading Strategies for Static Sites",{"path":1545,"title":1546},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fmetric-matched-fallback-fonts-with-size-adjust","Metric-Matched Fallback Fonts with size-adjust",{"path":1548,"title":1549},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fpreloading-fonts-without-double-downloads","Preloading Fonts Without Double Downloads",{"path":1551,"title":1552},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fself-hosting-google-fonts-to-eliminate-layout-shift","Self-Host Google Fonts to Eliminate Layout Shift",{"path":1554,"title":1555},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fsubsetting-variable-fonts-for-faster-first-render","Subsetting Variable Fonts for Faster First Render",{"path":1557,"title":1558},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fbuilding-an-image-cdn-pipeline-for-static-sites","Building an Image CDN Pipeline for Static Sites",{"path":1560,"title":1561},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fgenerating-open-graph-images-at-build-time","Generating Open Graph Images at Build Time",{"path":1563,"title":1564},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro","Image Optimization Pipelines in Astro",{"path":1566,"title":1567},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Flazy-loading-images-without-hurting-lcp","Lazy-Loading Images Without Hurting LCP",{"path":1569,"title":1570},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Foptimizing-webp-images-in-hugo-without-plugins","Optimizing WebP Images in Hugo Without Plugins",{"path":1572,"title":1573},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fresponsive-images-with-srcset-in-eleventy","Responsive Images with srcset in Eleventy",{"path":1575,"title":1576},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fserving-avif-with-fallbacks-on-static-sites","Serving AVIF With Fallbacks on Static Sites",{"path":1578,"title":1579},"\u002Fperformance-optimization-core-web-vitals-for-ssgs","Core Web Vitals Optimization for SSGs",{"path":1581,"title":1582},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fastro-islands-vs-full-hydration-performance","Astro Islands vs Full Hydration Performance",{"path":1584,"title":1585},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fdeferring-hydration-with-client-visible-in-astro","Deferring Hydration with client:visible in Astro",{"path":1587,"title":1588},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fhow-to-reduce-bundle-size-in-eleventy-builds","How to Reduce Bundle Size in Eleventy Builds",{"path":1590,"title":1591},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering","JavaScript Hydration & Partial Rendering",{"path":1593,"title":1594},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fmeasuring-inp-on-static-sites-with-real-user-monitoring","Measuring INP on Static Sites with RUM",{"path":1596,"title":1597},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Freplacing-react-islands-with-web-components","Replacing React Islands with Web Components",{"path":1599,"title":1600},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Feliminating-render-blocking-css-on-static-sites","Eliminating Render-Blocking CSS on Static Sites",{"path":1602,"title":1603},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Ffixing-lcp-on-text-heavy-documentation-pages","Fixing LCP on Text-Heavy Documentation Pages",{"path":1605,"title":1606},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites","Largest Contentful Paint Optimization for Static Sites",{"path":1608,"title":1609},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Fmeasuring-lcp-subparts-with-devtools","Measuring LCP Subparts with DevTools",{"path":1611,"title":1612},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Foptimizing-lcp-on-astro-with-priority-hints","Optimizing LCP on Astro with Priority Hints",{"path":1614,"title":1615},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Freducing-lcp-from-hero-images-on-static-sites","Reducing LCP from Hero Images on Static Sites",{"path":1617,"title":1618},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Fcomparing-lab-and-field-data-with-crux","Comparing Lab and Field Data with CrUX",{"path":1620,"title":1621},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci","Performance Budgets and Lighthouse CI",{"path":1623,"title":1624},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Freducing-lighthouse-score-variance-in-ci","Reducing Lighthouse Score Variance in CI",{"path":1626,"title":1627},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Frunning-webpagetest-scripts-against-preview-deploys","Running WebPageTest Scripts Against Preview Deploys",{"path":1629,"title":1630},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Fsetting-up-lighthouse-ci-for-a-static-site","Setting Up Lighthouse CI for a Static Site",{"path":1632,"title":1633},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Ftracking-bundle-size-per-pull-request","Tracking Bundle Size per Pull Request",{"path":1635,"title":1636},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Fwriting-a-performance-budget-that-fails-builds","Writing a Performance Budget That Fails Builds",{"path":1638,"title":1639},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fauditing-unused-preloads","Auditing Unused Preloads",{"path":1641,"title":1642},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed","Resource Hints and Navigation Speed",{"path":1644,"title":1645},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Finstant-navigation-with-speculation-rules","Instant Navigation with Speculation Rules",{"path":1647,"title":1648},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fpreconnect-vs-dns-prefetch-on-static-sites","Preconnect vs DNS-Prefetch on Static Sites",{"path":1650,"title":1651},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fprefetching-links-in-astro","Prefetching Links in Astro",{"path":1653,"title":1654},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fview-transitions-on-multi-page-static-sites","View Transitions on Multi-Page Static Sites",{"path":1656,"title":1657},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Fauditing-third-party-scripts-with-lighthouse","Auditing Third-Party Scripts With Lighthouse",{"path":1659,"title":1660},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites","Third-Party Script Performance on Static Sites",{"path":1662,"title":1663},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Flazy-loading-youtube-embeds-on-static-sites","Lazy-Loading YouTube Embeds on Static Sites",{"path":1665,"title":1666},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Floading-google-tag-manager-without-hurting-inp","Loading Google Tag Manager Without Hurting INP",{"path":1668,"title":1669},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Frunning-third-party-scripts-in-a-web-worker-with-partytown","Running Third-Party Scripts in a Web Worker with Partytown",{"path":1671,"title":1672},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Fself-hosting-analytics-to-cut-third-party-requests","Self-Hosting Analytics to Cut Third-Party Requests",{"path":1674,"title":1675},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fautomating-eleventy-deployments-with-cloudflare-pages","Automating Eleventy Deployments on Cloudflare Pages",{"path":1677,"title":1678},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fconfiguring-redirects-on-cloudflare-pages","Configuring Redirects on Cloudflare Pages",{"path":1680,"title":1681},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fcustom-domains-and-tls-on-cloudflare-pages","Custom Domains and TLS on Cloudflare Pages",{"path":1683,"title":1684},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fdeploying-hugo-to-cloudflare-pages-and-workers","Deploying Hugo to Cloudflare Pages and Workers",{"path":1686,"title":1687},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup","Cloudflare Pages Edge Caching Setup",{"path":1689,"title":1690},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fmigrating-from-cloudflare-pages-to-workers-static-assets","Migrating from Cloudflare Pages to Workers Static Assets",{"path":1692,"title":1693},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fchecking-links-in-pull-requests","Checking Links in Pull Requests",{"path":1695,"title":1696},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fdocs-as-code-review-workflow-for-writers","Docs-as-Code Review Workflow for Writers",{"path":1698,"title":1699},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Feditorial-checks-with-vale-in-ci","Editorial Checks with Vale in CI",{"path":1701,"title":1702},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams","Content Workflows for Documentation Teams",{"path":1704,"title":1705},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fscheduling-content-publication-with-cron-triggered-builds","Scheduling Content Publication With Cron-Triggered Builds",{"path":1707,"title":1708},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fwiring-a-headless-cms-to-a-static-build","Wiring a Headless CMS to a Static Build",{"path":1710,"title":1711},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fbuilding-astro-sites-with-github-actions","Building Astro Sites with GitHub Actions",{"path":1713,"title":1714},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fcaching-node-modules-in-github-actions-for-faster-ssg-builds","Caching node_modules in GitHub Actions",{"path":1716,"title":1717},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fdeploying-to-github-pages-with-actions","Deploying to GitHub Pages with Actions",{"path":1719,"title":1720},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fdeploying-to-multiple-environments-from-one-workflow","Deploying to Multiple Environments From One Workflow",{"path":1722,"title":1723},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fhow-to-set-up-github-actions-for-hugo-deployments","GitHub Actions for Hugo Deployments",{"path":1725,"title":1726},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds","GitHub Actions for Automated SSG Builds",{"path":1728,"title":1729},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fmatrix-builds-for-multi-site-monorepos","Matrix Builds for Multi-Site Monorepos",{"path":1731,"title":1732},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fcaching-hugo-builds-in-github-actions","Caching Hugo Builds in GitHub Actions",{"path":1734,"title":1735},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fenabling-incremental-builds-in-eleventy","Enabling Incremental Builds in Eleventy",{"path":1737,"title":1738},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fincremental-builds-in-astro-with-the-content-layer","Incremental Builds in Astro with the Content Layer",{"path":1740,"title":1741},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs","Incremental Builds and Build Caching for SSGs",{"path":1743,"title":1744},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fmeasuring-build-time-regressions-in-ci","Measuring Build-Time Regressions in CI",{"path":1746,"title":1747},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fremote-caching-with-turborepo-for-ssg-monorepos","Remote Caching with Turborepo for SSG Monorepos",{"path":1749,"title":1750},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fsharing-build-cache-across-ci-runners","Sharing Build Cache Across CI Runners",{"path":1752,"title":1753},"\u002Fproduction-ready-deployment-cicd-workflows","Production-Ready Deployment & CI\u002FCD for SSGs",{"path":1755,"title":1756},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Falerting-on-cache-hit-ratio-drops","Alerting on Cache Hit Ratio Drops",{"path":1758,"title":1759},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Fbuilding-a-core-web-vitals-dashboard-from-rum-data","Building a Core Web Vitals Dashboard from RUM Data",{"path":1761,"title":1762},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Fcrawling-for-broken-links-on-a-schedule","Crawling for Broken Links on a Schedule",{"path":1764,"title":1765},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production","Monitoring Static Sites in Production",{"path":1767,"title":1768},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Flogging-404s-at-the-edge","Logging 404s at the Edge",{"path":1770,"title":1771},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Fuptime-and-synthetic-checks-for-static-sites","Uptime and Synthetic Checks for Static Sites",{"path":1773,"title":1774},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fconfiguring-vercel-for-hugo-and-eleventy","Configuring Vercel for Hugo and Eleventy",{"path":1776,"title":1777},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies","Netlify vs Vercel Deployment Strategies",{"path":1779,"title":1780},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fnetlify-build-hooks-for-content-updates","Netlify Build Hooks for Content Updates",{"path":1782,"title":1783},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fnetlify-redirects-and-rewrites-for-static-sites","Netlify Redirects and Rewrites for Static Sites",{"path":1785,"title":1786},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fsetting-up-deploy-previews-on-netlify-for-every-pull-request","Netlify Deploy Previews for Every Pull Request",{"path":1788,"title":1789},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fvercel-isr-vs-static-generation-for-ssgs","Vercel ISR vs Static Generation for SSGs",{"path":1791,"title":1288},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fautomating-preview-deploy-pipelines-with-github-actions",{"path":1793,"title":1794},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fcleaning-up-stale-preview-deployments","Cleaning Up Stale Preview Deployments",{"path":1796,"title":1797},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests","Preview Environments for Pull Requests",{"path":1799,"title":1800},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fpassword-protecting-preview-deployments","Password-Protecting Preview Deployments",{"path":1802,"title":1803},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fpreviewing-headless-cms-drafts","Previewing Headless CMS Drafts",{"path":1805,"title":1806},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fvisual-regression-testing-on-preview-deploys","Visual Regression Testing on Preview Deploys",{"path":1808,"title":1809},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Fatomic-deploys-vs-incremental-uploads","Atomic Deploys vs Incremental Uploads",{"path":1811,"title":1812},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Fcanary-releases-for-static-sites","Canary Releases for Static Sites",{"path":1814,"title":1815},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Ffeature-flags-on-static-sites","Feature Flags on Static Sites",{"path":1817,"title":1818},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites","Rollbacks and Deploy Safety for Static Sites",{"path":1820,"title":1161},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Frolling-back-a-bad-static-deploy-in-under-a-minute",{"path":1822,"title":1823},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Frunning-smoke-tests-against-a-preview-url","Running Smoke Tests Against a Preview URL",{"path":1825,"title":1269},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fauditing-npm-dependencies-in-ssg-pipelines",{"path":1827,"title":1828},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fenabling-hsts-and-preload-safely","Enabling HSTS and Preload Safely",{"path":1830,"title":1831},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fhash-based-csp-for-inline-scripts-in-astro","Hash-Based CSP for Inline Scripts in Astro",{"path":1833,"title":24},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites",{"path":1331,"title":5},{"path":1836,"title":1837},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fsubresource-integrity-for-third-party-assets","Subresource Integrity for Third-Party Assets",{"path":1839,"title":1840},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fwriting-a-content-security-policy-for-a-static-site","Writing a Content Security Policy for a Static Site",{"path":1842,"title":1843},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fclean-urls-and-trailing-slashes-on-s3","Clean URLs and Trailing Slashes on S3",{"path":1845,"title":1846},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fcloudfront-functions-for-redirects","CloudFront Functions for Redirects",{"path":1848,"title":743},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fdeploying-a-static-site-to-s3-and-cloudfront",{"path":1850,"title":1851},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites","Self-Hosting Static Sites on S3, Nginx and Caddy",{"path":1853,"title":1854},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fserving-a-static-site-with-caddy","Serving a Static Site with Caddy",{"path":1856,"title":1857},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fserving-a-static-site-with-nginx","Serving a Static Site with Nginx",{"path":1859,"title":1860},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fzero-downtime-deploys-with-symlink-swaps","Zero-Downtime Deploys with Symlink Swaps",{"path":1862,"title":1863},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fadding-a-contact-form-with-cloudflare-workers","Adding a Contact Form with Cloudflare Workers",{"path":1865,"title":1866},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fhandling-form-submissions-on-a-static-site","Handling Form Submissions on a Static Site",{"path":1868,"title":1869},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites","Serverless Functions for Static Sites",{"path":1871,"title":1872},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fnetlify-functions-vs-cloudflare-workers","Netlify Functions vs Cloudflare Workers",{"path":1874,"title":1875},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fprotecting-a-static-site-behind-authentication","Protecting a Static Site Behind Authentication",{"path":1877,"title":1878},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fproxying-third-party-apis-from-an-edge-function","Proxying Third-Party APIs from an Edge Function",1789722847422]