feat(ci): add CSP, HSTS headers and PR preview deployments

[ace139]

Summary

This PR improves the Cloudflare Pages deployment setup to follow security best practices:

• Content-Security-Policy: Added CSP header that allows PostHog analytics, inline scripts (needed for Astro), and inline styles (Tailwind)
• HSTS: Added Strict-Transport-Security header (1 year, includeSubDomains) for browser-level HTTPS enforcement
• Headers file order: Fixed the _headers file to have specific paths first, global rules last (per Cloudflare best practices)
• PR preview deployments: New workflow that deploys PRs to branch-specific URLs and comments the preview link
• Deployment URL output: Production deployments now show URLs in GitHub Actions summary

Changes

File	Change
scripts/generate-headers.js	Restructured headers, added CSP and HSTS
.github/workflows/deploy.yml	Added deployment URL to job summary
.github/workflows/preview.yml	New workflow for PR previews

CSP Policy Details

default-src 'self'; 
script-src 'self' 'unsafe-inline' https://us.i.posthog.com; 
style-src 'self' 'unsafe-inline'; 
img-src 'self' data: https:; 
font-src 'self' data:; 
connect-src 'self' https://us.i.posthog.com; 
frame-ancestors 'none'; 
base-uri 'self'; 
form-action 'self'

Testing

• Build passes locally (bun run build)
• _headers file generated correctly
• CSP doesn't break site in browser (verify after deploy)
• PR preview workflow posts comment (verify with this PR)

What's NOT included

• preload directive for HSTS (requires hstspreload.org submission, irreversible)
• _redirects file (www redirect handled by Cloudflare Bulk Redirects, Astro handles trailing slashes)

---

Generated with Claude Code

[netlify]

✅ Deploy Preview for soumyo-dey ready!

Name	Link
🔨 Latest commit	4693bf3
🔍 Latest deploy log	https://app.netlify.com/projects/soumyo-dey/deploys/6974583e1c6c9d000835ac21
😎 Deploy Preview	https://deploy-preview-3--soumyo-dey.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 94 Accessibility: 97 Best Practices: 83 SEO: 92 PWA: - View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[github-actions]

Preview Deployment Ready!

Preview URL: https://24811bed.soumyo-com.pages.dev

This preview will be automatically updated when you push new commits.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4693bf365d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make CSP honor configurable PostHog host

The CSP hardcodes https://us.i.posthog.com for both script-src and connect-src, but the site’s PostHog host is configurable via PUBLIC_POSTHOG_HOST (see src/components/posthog.astro). If that env var is set to a non‑US or self‑hosted domain (e.g. https://eu.i.posthog.com), the browser will block loading /static/array.js and API calls, so analytics silently fails. Consider generating the CSP from the same configured host or allowing the alternative hosts you support.

Useful? React with 👍 / 👎.