[scanner] Live site serves broken canonical/og/sitemap URLs — deploy-gh-pages.yml SITE_URL still points at castrojo.github.io (404) after cncf org transfer

[hivecommons-hive]

Finding

The repository was transferred from castrojo/endusers to cncf/endusers, but .github/workflows/deploy-gh-pages.yml:58 still builds the site with:

SITE_URL: https://castrojo.github.io
BASE_URL: /endusers/

GitHub Pages does not redirect project-site URLs after an org transfer. Verified live today:

• https://castrojo.github.io/endusers/ → 404
• https://cncf.github.io/endusers/ → 200 (site actually serves here)

Because SITE_URL is stale, every absolute URL Docusaurus emits points at the 404 origin:

• sitemap.xml — every <loc> is https://castrojo.github.io/endusers/... (search engines are being fed 404 URLs)
• og:url, og:image, twitter:image, hreflang alternates — all castrojo.github.io, so social cards and link previews are broken
• Any <link rel="canonical"> / structured-data URLs are wrong for SEO

Related staleness in docusaurus.config.js:100,108: editUrl still points at https://github.com/castrojo/endusers/tree/main — works today only via GitHub's web redirect, and will break if a new castrojo/endusers repo is ever created.

Steps to Reproduce / Evidence

$ curl -s -o /dev/null -w '%{http_code}' https://castrojo.github.io/endusers/
404
$ curl -s https://cncf.github.io/endusers/sitemap.xml | head -c 400
...<loc>https://castrojo.github.io/endusers/blog</loc>...

Recommendation

1. In deploy-gh-pages.yml, change SITE_URL to https://cncf.github.io (or to https://endusers.cncf.io with BASE_URL: / if DNS cutover lands first — see the existing comment at lines 54-55).
2. Update both editUrl values in docusaurus.config.js to https://github.com/cncf/endusers/tree/main.
3. Note PR docs: record CNCF org transfer decision in ADR 0001 and project plans (issue #46) #167 already contains the SITE_URL fix but is CONFLICTING and bundles it with ADR/README rewrites; a focused one-line workflow PR would unblock this immediately.

---

Filed by scanner agent (ACMM L4 — issues-only mode)

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: 00b44df

— hive: agent=scanner backend=copilot model=kimi-k3

[hivecommons-hive]

Related stale reference worth sweeping into the same fix PR: package.json:59 still sets repository.url to git+https://github.com/castrojo/endusers.git. Git operations redirect today, but the npm metadata is wrong post-transfer and will break if castrojo/endusers is ever recreated.

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=scanner backend=copilot model=kimi-k3

[hivecommons-hive]

Scanner re-verification (2026-09-18, main @ 00b44df)

Confirmed and narrowed:

• https://cncf.github.io/endusers/ is the live, working site URL (HTTP 200) after the org transfer.
• endusers.cncf.io has no DNS record at all (NXDOMAIN) — the custom domain is not just unverified, it does not resolve. So the deploy workflow's comment premise ("when the custom domain in static/CNAME is verified and active") cannot be evaluated: static/CNAME does not exist in the repo.
• deploy-gh-pages.yml line 58 still builds with SITE_URL: https://castrojo.github.io → every canonical/og/sitemap URL on the live site 404s.
• ci.yml (line 32) already builds PRs with SITE_URL: https://cncf.github.io + BASE_URL: /endusers/ — the correct current value. The deploy workflow should match it.

Recommendation

Change deploy-gh-pages.yml to SITE_URL: https://cncf.github.io / BASE_URL: /endusers/ now (matches ci.yml and the serving URL). A custom-domain switch to endusers.cncf.io is a separate, staff-blocked task: DNS for that name must be created first, then static/CNAME added, then SITE_URL flipped. Suggest tracking that under #171 or a new infra issue rather than blocking this fix.

---

Analysis by scanner agent (ACMM L4 — issues-only mode)

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: 00b44df

— hive: agent=scanner backend=copilot model=kimi-k3

[hivecommons-hive]

Escalation update (2026-09-20, scanner re-verification)

The impact of this issue has gotten worse since filing:

• The site now deploys post-transfer to https://cncf.github.io/endusers/ (HTTP 200, last-modified 2026-09-16).
• Every canonical, og:url, and sitemap URL in that deployment still points at https://castrojo.github.io/endusers/ — and that origin now returns HTTP 404 (GitHub Pages no longer serves/redirects it after the org transfer). So every SEO/social URL the live site emits is a dead link, not just a wrong-host link.
• endusers.cncf.io still does not resolve (NXDOMAIN; no static/CNAME in repo), so there is currently no correct canonical host serving the site at all.

Root cause unchanged: .github/workflows/deploy-gh-pages.yml lines 58-59 hardcode SITE_URL: https://castrojo.github.io / BASE_URL: /endusers/ for the production deploy. Until DNS for endusers.cncf.io is provisioned, the lowest-risk correction is SITE_URL: https://cncf.github.io so canonical/og/sitemap URLs at least resolve.

---

Scanner agent (ACMM L4 — issues-only mode), re-verified against main @ 00b44df

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: 00b44df

— hive: agent=scanner backend=copilot model=kimi-k3

[hivecommons-hive]

A merged PR referenced this issue without closing it. Carrying the remainder back here so the issue timeline shows what is still open.

• fix(config): point editUrl at cncf/endusers, not castrojo #245 — fix(config): point editUrl at cncf/endusers, not castrojo (fix(config): point editUrl at cncf/endusers, not castrojo #245)

Remainder from the PR body:

After the repo transfer from castrojo/endusers to cncf/endusers, several hard-coded URLs still pointed at the old castrojo org:

This comment is edited in place by the task-list sweep on every cycle; it is not duplicated.

[hivecommons-hive]

Re-verified on main @ 678e427 after external PR #245 merged: not resolved. deploy-gh-pages.yml:58 still sets SITE_URL: https://castrojo.github.io, so canonical/og/sitemap URLs still point at the pre-transfer domain (which 404s). #245 did not touch the SITE_URL/BASE_URL env in the deploy workflow.

— scanner agent (reap pass)

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=scanner backend=copilot model=kimi-k3