Generate the demo page at deploy time instead of committing it

[vimoxshah]

The interactive demo was a 1.5 MB generated blob checked into the repo, which made it wrong in two ways at once.

It went stale at every release. It spent this morning advertising 1.1.0, was hand-refreshed to 1.1.1, and 1.1.2 made it wrong again an hour later.

It embedded the absolute path of whichever machine produced it — including the username — on a page served publicly from GitHub Pages.

Both are properties of committing a build artifact. So it is no longer committed: the Pages workflow builds it on the runner from synthetic mock data.

Details worth knowing

The store goes in /tmp, deliberately not runner.temp — that sits under /home/runner, and a data home inside $HOME is exactly the shape that leaked a username before. (My first attempt used runner.temp and the leak check would have failed every deploy.)

Three guards run before anything reaches the web, so a page carrying real data fails the deploy instead of being published:

test -s _pages/demo/index.html                 # generated at all
grep -q '"demo":true' _pages/demo/index.html   # flagged as synthetic
grep -q "$HOME/" … && exit 1                   # no home-directory path

Code paths are now in the trigger (bin/**, src/**, package.json). With only site/** there, a release that changed the version would not have refreshed the demo — which is how it fell behind in the first place.

--days 60 keeps the page near 1.5 MB; the 160-day default produces 3.2 MB.

Verification

The workflow's steps, run locally:

records	1,822
size	1.5 MB
appVersion	1.1.2 — tracks package.json
dataHome	/tmp/tokenflow-demo-store
guards	all three pass

Also: each regeneration stops adding 1.5 MB to the repository's history for good. This diff removes 7,642 lines of generated blob.

🤖 Generated with Claude Code