fix(sitemap): render per request; ISR cached a gig-less fallback

[ralyodio]

Problem

https://ugig.net/sitemap.xml lists only the 23 static URLs: no gigs, profiles, posts, skills or blog posts. The response is x-nextjs-cache: HIT.

With revalidate = 3600, the first render happens during next build. The build has no SUPABASE_SERVICE_ROLE_KEY (only NEXT_PUBLIC_* build args), so createServiceClient() throws, the catch returns the static pages, and that result is cached. Every deploy starts the cycle again. The app container does have the key.

Fix

• export const dynamic = "force-dynamic": the sitemap renders per request (6 indexed selects).
• Both fallbacks now console.error the reason instead of hiding it.

Tests

New src/app/sitemap.test.ts:

• it is dynamic, not ISR;
• profiles are listed with is_spam = false (the fix(seo): keep spam-flagged profiles out of search engines #587 rule);
• it falls back to static pages when the service client is missing.

I'll check the live URL count after deploy.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

47 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 8 | LOW: 38

Severity	Rule	Location
HIGH	js-ssrf-outbound-request	scripts/scan-all-skills.ts:38
MEDIUM	js-open-redirect	src/app/agent-login/AgentLoginForm.tsx:38
MEDIUM	js-unescaped-html-sink	src/app/blog/[slug]/page.tsx:79
MEDIUM	js-open-redirect	src/app/dashboard/subscription/page.tsx:90
MEDIUM	js-open-redirect	src/app/dashboard/subscription/page.tsx:113
MEDIUM	js-open-redirect	src/app/dashboard/subscription/page.tsx:144
MEDIUM	js-open-redirect	src/components/funding/FundingClient.tsx:137
MEDIUM	js-dynamic-code-execution	src/lib/skills/metadata-extract.ts:300
MEDIUM	js-dynamic-code-execution	src/lib/skills/security-scan.ts:48
LOW	secret-generic-credential	cli/src/commands/auth.test.ts:66
LOW	secret-generic-credential	cli/src/commands/auth.test.ts:85
LOW	secret-generic-api-key	docs/agents/integration-guide.md:893
LOW	secret-generic-credential	src/app/api/auth/login/route.test.ts:53
LOW	secret-generic-credential	src/app/api/auth/login/route.test.ts:68
LOW	secret-generic-credential	src/app/api/auth/login/route.test.ts:87
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:158
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:182
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:193
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:232
LOW	js-dynamic-code-execution	src/app/api/skills/[slug]/scan/route.test.ts:212
LOW	js-dynamic-code-execution	src/app/api/skills/[slug]/scan/route.test.ts:223
LOW	js-dynamic-code-execution	src/app/api/skills/[slug]/scan/route.test.ts:239
LOW	secret-generic-credential	src/lib/api.test.ts:126
LOW	secret-generic-credential	src/lib/api.test.ts:131
LOW	js-dynamic-code-execution	src/lib/skills/composite-scanner.test.ts:106
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:36
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:44
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:66
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:81
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:94
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:103
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:118
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:144
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:162
LOW	js-dynamic-code-execution	src/lib/skills/security-scan.test.ts:28
LOW	js-dynamic-code-execution	src/lib/skills/url-import.test.ts:178
LOW	js-dynamic-code-execution	src/lib/skills/url-import.test.ts:191
LOW	secret-jwt	src/lib/supabase/service.test.ts:16
LOW	secret-jwt	src/lib/supabase/service.test.ts:40
LOW	secret-generic-credential	src/lib/validations.test.ts:148
LOW	secret-generic-credential	src/lib/validations.test.ts:512
LOW	secret-generic-credential	src/lib/validations.test.ts:523
LOW	secret-generic-credential	src/lib/validations.test.ts:538
LOW	secret-generic-credential	src/lib/validations.test.ts:548
LOW	secret-generic-credential	src/lib/validations.test.ts:557
LOW	secret-generic-credential	src/lib/validations.test.ts:567
LOW	secret-generic-credential	src/lib/validations.test.ts:582

Snippets are redacted; ThreatCrush never prints matched credential material.