Series./blog.sh v1.4

./blog.sh 1.4 is out — release on GitHub.

The widest release since 1.0. Three things arrived: the commits widget reads Gitea and Forgejo — asked for by one of the first people outside this project to run the engine, because most of the Fediverse keeps its code on Codeberg, and mirroring to GitHub for one sidebar card was the workaround. widgets.commits.instance takes the server's address; that is the whole configuration. Comments work on GoToSocial — found on arch-linux.cz, where no post had ever shown a single comment, silently; my own tests had Mastodon on both ends, so they could never have caught it. And the engine now speaks the site's language everywhere: a Czech or German site used to watch its own deploy and build warnings go by in English, one line above a translated sentence. Sixty-odd sentences moved into the locales.

Under those sits the real work of this release: four adversarial audit rounds over real archives, the last one aimed at the fixes themselves — which is how it caught three of my own regressions before anyone else could. What came out of it is a principle more than a list: nothing fails silently. check refuses everything the build refuses. A crash mid-way through a queue move cannot cost a post. An install in a folder called blog [1] builds the site instead of silently publishing an empty one. An imported javascript: link becomes a dead anchor. A deploy pointed at a new server uploads everything instead of trusting the old server's records.

Nothing to migrate — git pull, rebuild, deploy. Expect a modest one: on my own 4400-post archive, eighteen files change — the stylesheet, two scripts, and one line in each draft preview whose tags have no listing page yet. Published posts do not move by a byte.

Full notes → release

The sidebar has a commits card. Until now it read GitHub, full stop — which is a strange default for an engine whose natural habitat is the Fediverse, where the code lives on Codeberg or on somebody's own Forgejo, and GitHub is the mirror you keep for one widget's sake.

One of the first people outside this project to run the engine asked the obvious question, and the answer shipped: widgets.commits.instance takes the server's address, and that is the whole configuration.

One key, not two

There is no forge_type beside it. An address already answers what kind of host it is — Gitea and Forgejo speak the same API, and a key that must agree with another key is a config mistake waiting for its moment. Leave instance out and the card reads GitHub, exactly as before.

Cheaper than the original

The forge path costs one request where GitHub costs one per commit, because a Gitea activity item carries the commits it is about — message and timestamp included. A card on your own Forgejo is lighter on your own server than the GitHub card ever was on theirs.

The mistake is caught standing up

An empty commits card is indistinguishable from "has not pushed lately", so doctor checks the address before that ambiguity can start: a pasted @handle or a bare host name is refused with a sentence, and an address with a path after it is flagged as worth checking — with the API endpoint that settles it. ./style.sh asks the new question too, on configs written before this key existed as well.

Comments here are replies to a toot, and GoToSocial speaks Mastodon's API — so comments on a GTS instance should have simply worked. They did not, not once, and nobody saw it fail: arch-linux.cz, the first site to pair this engine with its own GTS instance, had never shown a single comment under any post. My own tests had Mastodon on both ends, so they could never have caught it.

Dialect is not language

Two accents were in the way. GoToSocial writes a status address in its own shape, and the engine's pattern insisted on Mastodon's — a numeric id where GTS answers with a 26-character ULID. And GTS requires a token even to read a public thread, where Mastodon hands it to anyone who asks. The first accent broke the address parsing; the second broke the entire idea of live comments, which is a visitor's browser fetching the thread — a browser you cannot give a token to.

Moderation is the door in

So on GoToSocial, comments are the moderated kind by construction: comments.approval: fav, and the cron reads the thread with the token, server-side, publishing the replies you star. The side effect is one Mastodon sites choose deliberately: visitors' browsers stop contacting your instance at all.

doctor --online now tests the capability, not the brand — can an anonymous request read the thread? — so a Mastodon instance in secure mode gets the same honest answer. And the fix was confirmed where the bug was found: the first starred reply on arch-linux.cz appeared under its post the same day 1.4 landed there.