.github/workflows/nextjs.yml (2)

39-39: Trim trailing whitespace flagged by yamllint.

Remove trailing spaces to keep CI green.

Apply:

-          
+

-        
+

Also applies to: 64-64

---

45-52: Avoid double-configuring Next export/basePath.

You already manage output/basePath in next.config.ts. Keeping static_site_generator: next is fine, but if you prefer single source of truth, remove it and run pnpm next build && pnpm next export, or keep it and drop the conditional config. Pick one to reduce surprise.

.github/workflows/cleanup-preview.yml (2)

24-38: Paginate deployments to avoid missing older ones.

listDeployments returns a single page by default. Use pagination to mark all as inactive.

Apply:

-              const { data: deployments } = await github.rest.repos.listDeployments({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                environment: environmentName,
-              });
+              const deployments = await github.paginate(
+                github.rest.repos.listDeployments,
+                {
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  environment: environmentName,
+                  per_page: 100,
+                }
+              );

---

54-61: Target the PR number explicitly in comment API call.

context.issue.number is usually fine, but github.event.pull_request.number is unambiguous on pull_request events.

Apply:

-              issue_number: context.issue.number,
+              issue_number: ${{ github.event.pull_request.number }},

.github/workflows/preview-deploy.yml (1)

99-103: Restrict bot comment matching to this workflow’s author.

Filtering by user.type === 'Bot' risks editing other bots’ comments. Match github-actions[bot] instead.

Apply:

-            const botComment = comments.find(comment =>
-              comment.user.type === 'Bot' &&
-              comment.body.includes('🚀 Preview deployment')
-            );
+            const botComment = comments.find(comment =>
+              comment.user.login === 'github-actions[bot]' &&
+              comment.body.includes('🚀 Preview deployment')
+            );

next.config.ts (1)

6-8: Make basePath configurable for forks and future renames.

Allow override via env to avoid hardcoding the repo name.

Apply:

-    basePath: "/arda-homepage",
+    basePath: process.env.NEXT_PUBLIC_BASE_PATH ?? "/arda-homepage",

components/subscribeForm.tsx (4)

13-22: Use native form validation and trim the email; tighten the submit handler type

Rely on the browser’s type="email" + required instead of the custom includes('@') check, and trim whitespace. This reduces false positives and duplicates less logic.

-    async function onSubmit(e: React.FormEvent) {
+    async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
         e.preventDefault();
-        
-        if (!email || !email.includes('@')) {
-            toast({
-                variant: 'destructive',
-                title: "Please enter a valid email address",
-            });
-            return;
-        }
+        const form = e.currentTarget as HTMLFormElement;
+        const trimmedEmail = email.trim();
+        if (!form.checkValidity()) {
+            form.reportValidity();
+            return;
+        }

---

39-46: Opaque responses can mask failures; consider a tiny server proxy for reliability + anti-spam

mode: 'no-cors' returns an opaque response and always “succeeds,” so network or form changes can silently drop signups. A server endpoint lets you verify status, add rate-limiting, bot checks, and swap providers later without client changes.

Example (Next.js App Router):

// app/api/subscribe/route.ts
export async function POST(req: Request) {
  const { email } = await req.json();
  if (!email) return new Response("Email required", { status: 400 });

  const formId = process.env.GOOGLE_FORM_ID!;
  const entryKey = process.env.GOOGLE_FORM_ENTRY_KEY!; // "entry.123456"
  const body = new URLSearchParams({ [entryKey]: email });

  const resp = await fetch(`https://docs.google.com/forms/d/e/${formId}/formResponse`, {
    method: "POST",
    body,
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
  });

  return resp.ok ? new Response(null, { status: 204 }) : new Response("Upstream error", { status: 502 });
}

Then swap the client call:

- await fetch(endpoint, { method:'POST', body: formData, mode:'no-cors', credentials:'omit', referrerPolicy:'no-referrer' });
+ await fetch('/api/subscribe', {
+   method: 'POST',
+   headers: { 'Content-Type': 'application/json' },
+   body: JSON.stringify({ email: trimmedEmail }),
+});

---

63-64: Preserve a visible focus style

focus-visible:ring-0 and border-none remove focus cues. Provide a visible focus style to meet a11y expectations.

- className="rounded-xl backdrop-blur-lg h-12 font-semibold text-base placeholder:text-white text-white bg-white/20 border-none focus-visible:ring-0 focus-visible:border-none"
+ className="rounded-xl backdrop-blur-lg h-12 font-semibold text-base placeholder:text-white text-white bg-white/20 border-none focus-visible:ring-2 focus-visible:ring-white/70 focus-visible:ring-offset-2 focus-visible:ring-offset-black"

---

73-80: Minor a11y polish on button/loading state

Expose loading to AT and hide the spinner from screen readers.

-                <Button 
+                <Button 
                     disabled={isLoading} 
                     size={'lg'} 
                     className="h-12 rounded-xl max-w-[122px] w-full font-semibold text-white" 
                     type="submit"
+                    aria-busy={isLoading}
                 >
                     Subscribe
-                    {isLoading && <Loader2Icon className="animate-spin ml-2" />}
+                    {isLoading && <Loader2Icon aria-hidden="true" className="animate-spin ml-2" />}
                 </Button>

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

components/subscribeForm.tsx (2)

62-70: Add accessible label and form attributes

Screen readers need a label; also add id/name and helpful hints. This mirrors prior feedback.

-                <div className="max-w-[360px] w-full">
-                    <Input 
+                <div className="max-w-[360px] w-full">
+                    <label htmlFor="email" className="sr-only">Email address</label>
+                    <Input 
                         className="rounded-xl backdrop-blur-lg h-12 font-semibold text-base placeholder:text-white text-white bg-white/20 border-none focus-visible:ring-0 focus-visible:border-none" 
-                        placeholder="Email"
-                        type="email"
-                        value={email}
-                        onChange={(e) => setEmail(e.target.value)}
-                        required
-                        disabled={isLoading}
+                        placeholder="Email"
+                        type="email"
+                        id="email"
+                        name="email"
+                        autoComplete="email"
+                        inputMode="email"
+                        enterKeyHint="send"
+                        aria-disabled={isLoading}
+                        value={email}
+                        onChange={(e) => setEmail(e.target.value)}
+                        required
+                        disabled={isLoading}

---

27-37: Don’t hardcode Google Form IDs; read from env and minimize privacy leakage

Use NEXT_PUBLIC_ env vars and omit credentials/referrer. This was raised earlier; reapplying here.

-            // Submit to Google Form in the background
-            const formData = new FormData();
-            // You'll need to replace 'entry.XXXXXXXXX' with the actual entry ID from your Google Form
-            // To find this: Right-click on your Google Form → View Page Source → Search for "entry."
-            formData.append('entry.2000592701', email); // Replace with your actual entry ID
-            
-            await fetch('https://docs.google.com/forms/d/e/1FAIpQLSdbXDWhJlT_1PRIwfj15ycqjbApzUy2znsmQk02TpIYrTgwqw/formResponse', {
-                method: 'POST',
-                body: formData,
-                mode: 'no-cors' // Important: This prevents CORS errors with Google Forms
-            });
+            // Submit to Google Form in the background
+            const formId = process.env.NEXT_PUBLIC_GOOGLE_FORM_ID;
+            const entryKey = process.env.NEXT_PUBLIC_GOOGLE_FORM_ENTRY_KEY; // e.g., "entry.2000592701"
+            if (!formId || !entryKey) {
+                toast({ variant: 'destructive', title: "Mailing list is temporarily unavailable. Please try again later." });
+                return;
+            }
+            const formData = new FormData();
+            formData.append(entryKey, email.trim());
+
+            const endpoint = `https://docs.google.com/forms/d/e/${formId}/formResponse`;
+            await fetch(endpoint, {
+                method: 'POST',
+                body: formData,
+                mode: 'no-cors',          // prevents CORS errors with Google Forms
+                credentials: 'omit',      // do not send cookies
+                referrerPolicy: 'no-referrer',
+            });

.github/workflows/nextjs.yml (4)

36-36: Remove trailing spaces flagged by YAMLlint

Strips cosmetic trailing whitespace to keep linters green.

-        uses: pnpm/action-setup@v4
-          
+        uses: pnpm/action-setup@v4

-        run: pnpm install --frozen-lockfile
-        
+        run: pnpm install --frozen-lockfile

Also applies to: 62-62

---

56-60: Broaden Next cache key to bust on config/basePath changes

Include Next/TS config files to avoid reusing stale .next/cache after config updates.

-          key: ${{ runner.os }}-nextjs-${{ hashFiles('**/pnpm-lock.yaml') }}-${{ hashFiles('**.[jt]s', '**.[jt]sx') }}
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('**/pnpm-lock.yaml') }}-${{ hashFiles('**/*.{js,jsx,ts,tsx,css,scss}', 'next.config.*', 'tsconfig*.json', 'package.json') }}
           # If source files changed but packages didn't, rebuild from a prior cache.
           restore-keys: |
-            ${{ runner.os }}-nextjs-${{ hashFiles('**/pnpm-lock.yaml') }}-
+            ${{ runner.os }}-nextjs-${{ hashFiles('**/pnpm-lock.yaml') }}-

---

61-66: Disable Next telemetry in CI

Optional, but common in CI to reduce noise and network calls.

       - name: Build with Next.js
-        run: pnpm next build
-        env:
-          NODE_ENV: production
+        run: pnpm next build
+        env:
+          NODE_ENV: production
+          NEXT_TELEMETRY_DISABLED: '1'

---

34-36: Pin pnpm version to 9.15.3 in CI

 .github/workflows/nextjs.yml
   34|       - name: Install pnpm
-  35|         uses: pnpm/action-setup@v4
+  35|         uses: pnpm/action-setup@v4
+  36|         with:
+  37|           version: 9.15.3
+  38|           run_install: false

Aligns the action’s pnpm version with package.json’s packageManager (pnpm@9.15.3).

components/subscribeForm.tsx (2)

13-22: Trim input and use built-in form validity instead of '@' check

Relies on native email validation and avoids false positives; also trims spaces.

-    async function onSubmit(e: React.FormEvent) {
+    async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
         e.preventDefault();
-        
-        if (!email || !email.includes('@')) {
-            toast({
-                variant: 'destructive',
-                title: "Please enter a valid email address",
-            });
-            return;
-        }
+        const trimmedEmail = email.trim();
+        if (!trimmedEmail) {
+            toast({ variant: 'destructive', title: "Please enter a valid email address" });
+            return;
+        }
+        // Trigger native HTML5 validation for type="email"/required
+        if (!e.currentTarget.reportValidity()) return;

---

72-80: Expose loading state to assistive tech

Add aria-busy for better accessibility during submission.

-                <Button 
-                    disabled={isLoading} 
+                <Button 
+                    disabled={isLoading} 
+                    aria-busy={isLoading}
                     size={'lg'} 
                     className="h-12 rounded-xl max-w-[122px] w-full font-semibold text-white" 
                     type="submit"
                 >

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

.github/workflows/preview-deploy.yml (5)

12-16: Scope concurrency to the PR number for stability.

Using github.ref works, but github.event.pull_request.number is simpler and more robust across ref shapes.

-concurrency:
-  group: "preview-${{ github.ref }}"
-  cancel-in-progress: true
+concurrency:
+  group: "preview-pr-${{ github.event.pull_request.number }}"
+  cancel-in-progress: true

---

24-34: Pin pnpm and tighten cache for reproducibility.

• Explicitly pin pnpm to avoid surprise upgrades.
• Add cache-dependency-path so the cache keys off the lockfile (especially helpful for workspaces).

-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
         if: github.event.action != 'closed'
+        with:
+          version: '9' # or your repo’s required version

       - name: Setup Node
         uses: actions/setup-node@v4
         if: github.event.action != 'closed'
         with:
           node-version: "22"
-          cache: 'pnpm'
+          cache: 'pnpm'
+          cache-dependency-path: |
+            pnpm-lock.yaml
+            **/pnpm-lock.yaml

---

39-44: Ensure static export actually lands in ./out before deploying.

Given the action publishes ./out, add a quick guard to fail fast if export didn’t produce it (e.g., if next.config.ts’s output: 'export' isn’t active).

       - name: Build with Next.js
         if: github.event.action != 'closed'
-        run: pnpm next build
+        run: |
+          pnpm next build
+          test -f out/index.html || { echo "Expected out/index.html not found. Did Next static export run?"; exit 1; }
         env:
           NODE_ENV: production
+          NEXT_TELEMETRY_DISABLED: '1'

---

45-50: Make teardown on PR close explicit and resilient.

The action auto-tears down on closed, but the build steps are skipped then, which is fine. To be extra safe (and to run even if earlier steps fail), consider splitting deploy vs teardown with explicit conditions.

-      - name: Deploy PR Preview
-        uses: rossjrw/pr-preview-action@v1
-        with:
-          source-dir: ./out/
-          preview-branch: gh-pages
-          umbrella-dir: pr-preview
+      - name: Deploy PR Preview
+        if: github.event.action != 'closed'
+        uses: rossjrw/pr-preview-action@v1
+        with:
+          source-dir: ./out/
+          preview-branch: gh-pages
+          umbrella-dir: pr-preview
+
+      - name: Teardown PR Preview
+        if: github.event.action == 'closed'
+        uses: rossjrw/pr-preview-action@v1
+        with:
+          preview-branch: gh-pages
+          umbrella-dir: pr-preview

Note: The action supports teardown on close without needing a built source-dir.

Would you like me to confirm the exact teardown inputs against the current action docs?

---

8-11: Permissions look correct; consider scoping to the job if desired.

contents: write and pull-requests: write are needed for branch pushes and PR comments. Optionally move these to the job for least-privilege scoping.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.