feat(site): CodeIndeX marketing site — Vite build, Cloudflare Pages

.github/workflows/ci-site.yml

@@ -0,0 +1,86 @@
+name: CI Site
+
+on:
+  pull_request:
+    paths:
+      - "site/**"
+      - ".github/workflows/ci-site.yml"
+  push:
+    branches: [main, develop]
+    paths:
+      - "site/**"
+      - ".github/workflows/ci-site.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build site
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: site
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: site/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      # The site must never regress to the pre-audit claims or dev-grade
+      # tooling. Fails the build if a forbidden string appears in the output.
+      # CSS is included on purpose — a CDN font/@import regression would land
+      # there, not in HTML/JS. \b guards keep Rollup's base64 chunk hashes
+      # from false-positiving.
+      - name: Check for forbidden claims
+        run: |
+          FORBIDDEN='v0\.5|200\+ languages|21 MB|fsnotify|unpkg\.com|\bbabel\b'
+          if grep -rniE "$FORBIDDEN" dist/ --include='*.html' --include='*.js' --include='*.css'; then
+            echo "::error::Forbidden string found in built site (stale claim or dev-grade dependency)"
+            exit 1
+          fi
+          echo "OK: no forbidden strings in dist/"
+
+      # The site must never advertise a stale OR fake version: the plugin
+      # version must match plugin.json in this repo, and the server/CLI
+      # versions must equal the NEWEST release tags — not merely exist.
+      # "Exists" was the original rule and it was too weak: after
+      # server/v0.12.3 shipped, a versions.js still saying 0.12.2 passed
+      # (0.12.2 is a real tag) and the deployed site kept advertising the
+      # old release. Comparing against the newest tag closes that drift.
+      - name: Check version consistency
+        run: |
+          # Anchor on the full `export const <NAME> =` declaration: an
+          # unanchored grep for PLUGIN_VERSION also matches the
+          # COWORK_PLUGIN_VERSION line, which made $PLUGIN two-valued and
+          # the comparison below fail unconditionally.
+          v() { grep -oE "^export const $1 = '[^']+'" src/shared/versions.js | cut -d"'" -f2; }
+          SERVER=$(v SERVER_VERSION); CLI=$(v CLI_VERSION); PLUGIN=$(v PLUGIN_VERSION)
+          PLUGIN_JSON=$(node -p "require('../plugins/cix/.claude-plugin/plugin.json').version")
+          TAGS=$(git ls-remote --tags origin)
+          # Newest semver tag per release stream. The trailing `$` anchor skips
+          # the `^{}` peeled refs that annotated tags add to ls-remote output.
+          newest() { echo "$TAGS" | grep -oE "refs/tags/$1/v[0-9]+\.[0-9]+\.[0-9]+$" | sed "s#refs/tags/$1/v##" | sort -V | tail -n1; }
+          NEWEST_SERVER=$(newest server); NEWEST_CLI=$(newest cli)
+          echo "site: server=$SERVER cli=$CLI plugin=$PLUGIN"
+          echo "repo: server=$NEWEST_SERVER cli=$NEWEST_CLI plugin.json=$PLUGIN_JSON"
+          FAIL=0
+          if [ "$PLUGIN" != "$PLUGIN_JSON" ]; then
+            echo "::error::versions.js PLUGIN_VERSION ($PLUGIN) != plugins/cix plugin.json ($PLUGIN_JSON)"; FAIL=1
+          fi
+          if [ "$SERVER" != "$NEWEST_SERVER" ]; then
+            echo "::error::versions.js SERVER_VERSION ($SERVER) != newest release server/v$NEWEST_SERVER — bump it so the site stops advertising a stale version"; FAIL=1
+          fi
+          if [ "$CLI" != "$NEWEST_CLI" ]; then
+            echo "::error::versions.js CLI_VERSION ($CLI) != newest release cli/v$NEWEST_CLI — bump it so the site stops advertising a stale version"; FAIL=1
+          fi
+          exit $FAIL

.github/workflows/prerelease-cli.yml

@@ -110,7 +110,7 @@ jobs:
             --repo "${{ github.repository }}" || true
 
       - name: Create develop release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: cli/develop
           target_commitish: develop

.github/workflows/prerelease-server.yml

@@ -36,7 +36,7 @@ jobs:
         run: server/scripts/check-llama-pin.sh server/Dockerfile.cuda
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4.3.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/release-cli.yml

@@ -97,7 +97,7 @@ jobs:
         run: echo "version=${GITHUB_REF_NAME#cli/}" >> "$GITHUB_OUTPUT"
 
       - name: Create GitHub release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           name: "CLI ${{ steps.ver.outputs.version }}"
           files: |

.github/workflows/release-server.yml

@@ -69,7 +69,7 @@ jobs:
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4.3.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -134,7 +134,7 @@ jobs:
         run: server/scripts/check-llama-pin.sh server/Dockerfile.cuda
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4.3.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -192,7 +192,7 @@ jobs:
         run: echo "version=${GITHUB_REF_NAME#server/}" >> "$GITHUB_OUTPUT"
 
       - name: Create GitHub release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           name: "Server ${{ steps.ver.outputs.version }}"
           generate_release_notes: true

.gitignore

@@ -47,7 +47,13 @@ cli/dist/
 # Server build artifacts + runtime logs
 server/dist/
 server/exec.log
+# Root scratch dir only — anchored: a bare "tmp" would silently ignore any
+# nested file/dir named tmp (same pitfall as the docs/ pattern below).
+/tmp/
 
+# Marketing site (site/) build artifacts
+site/node_modules/
+site/dist/
 # Dashboard build output — produced by `make dashboard-build`.
 # A committed `.gitkeep` keeps dist/ non-empty so `//go:embed all:dist` works
 # on a fresh clone (the embed.FS needs at least one entry). The real
@@ -62,11 +68,10 @@ server/internal/httpapi/dashboard/dist/*
 .python-version
 
 # Local docs (top-level docs/ is a notebook directory per CLAUDE.md;
-# tracked project documentation lives in doc/). Exception below for the
+# tracked project documentation lives in doc/). Anchored to the repo root —
+# a bare "docs/" would also swallow nested dirs like site/docs/ and the
 # embedded Swagger UI bundle inside the Go server package.
-docs/
-!server/internal/httpapi/docs/
-!server/internal/httpapi/docs/**
+/docs/
 
 # Claude Code
 .claude/

CITATION.cff

@@ -1,10 +1,11 @@
 cff-version: 1.2.0
-title: "cix — Semantic Code Index"
+title: "cix — CodeIndeX (semantic code index)"
 message: "If you use this software, please cite it as below."
 type: software
 authors:
   - alias: dvcdsys
 repository-code: "https://github.com/dvcdsys/code-index"
+url: "https://codeindex.app"
 license: MIT
 keywords:
   - code-search

README.md

@@ -9,15 +9,15 @@
 ██║     ██║ ╚███╔╝
 ██║     ██║ ██╔██╗
 ╚██████╗██║██╔╝ ██╗
- ╚═════╝╚═╝╚═╝  ╚═╝  Code IndeX
+ ╚═════╝╚═╝╚═╝  ╚═╝  CodeIndeX
 ```
 
 [![Release: Server](https://github.com/dvcdsys/code-index/actions/workflows/release-server.yml/badge.svg)](https://github.com/dvcdsys/code-index/actions/workflows/release-server.yml)
 [![Release: CLI](https://github.com/dvcdsys/code-index/actions/workflows/release-cli.yml/badge.svg)](https://github.com/dvcdsys/code-index/actions/workflows/release-cli.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Docker Hub](https://img.shields.io/docker/pulls/dvcdsys/code-index)](https://hub.docker.com/r/dvcdsys/code-index)
 
-Search your codebase by meaning, not just text. Self-hosted, embeddings-based, works with any agent or terminal — with a full web dashboard and multi-repo workspace search.
+**cix — CodeIndeX.** Search your codebase by meaning, not just text. Self-hosted, embeddings-based, works with any agent or terminal — with a full web dashboard and multi-repo workspace search. Website: [codeindex.app](https://codeindex.app)
 
 ```bash
 cix search "authentication middleware"

cli/README.md

@@ -1,4 +1,4 @@
-# `cix` — Code IndeX CLI
+# `cix` — CodeIndeX CLI
 
 A thin Go client for the `cix-server` semantic code index. Runs `init`,
 `search`, `symbols`, `def`, `refs`, `files`, `summary`, `watch`,