fix(website): serve blog pages correctly, add serving regression test

.github/workflows/stacker-website.yml

@@ -44,6 +44,17 @@ jobs:
             type=sha,prefix={{branch}}-,format=short
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
 
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Serving regression test
+        working-directory: ./website
+        run: |
+          npm ci
+          npm test
+
       - name: Build and push
         uses: docker/build-push-action@v6
         with:

CHANGELOG.md

@@ -18,6 +18,10 @@ All notable changes to this project will be documented in this file.
 
 - A root admin may smoke-clone an unpromoted bake (`channel: "unstable"`), matching the access that already allowed `POST /api/admin/bake`.
 
+### Fixed — Website blog serving
+
+- `stacker.my/blog` and its article URLs serve the blog pages again: the website image no longer runs `serve` in SPA mode, which rewrote every blog path to the landing page.
+
 ## [0.3.5] — 2026-10-19
 
 ### Added — Managed server billing

docker-compose.dev.yml

@@ -17,7 +17,7 @@ networks:
 
 services:
   stacker:
-    image: trydirect/stacker:0.0.9
+    image: trydirect/stacker:v0.3.2
     container_name: stacker-dev
     restart: always
     networks:
@@ -54,7 +54,7 @@ services:
   # MQ Listener - Consumes deployment progress messages from Install Service
   # and updates deployment status in Stacker database
   stacker-mq-listener:
-    image: trydirect/stacker:0.0.9
+    image: trydirect/stacker:v0.3.2
     container_name: stacker-mq-listener-dev
     restart: always
     networks:

package.json

@@ -1,5 +1,5 @@
 {
   "dependencies": {
-    "ws": "^8.21.0"
+    "ws": "^8.22.0"
   }
 }

scripts/check-staged-secrets.sh

@@ -115,6 +115,8 @@ findings=$(printf '%s\n' "$added" | awk -v keyre="$SECRET_KEY_RE" '
     }
 
     # 2. A long hex or base64 blob as a value, whatever the key is called.
+    #    Cargo.lock checksums are public crate hashes, not secrets.
+    path ~ /Cargo[.]lock$/ && content ~ /checksum = / { next }
     value ~ /^[0-9a-fA-F]{32,}$/ {
         print path ":" lineno ": " length(value) "-char hex value"
         next