TODO

• Every page of the default source loads https://www.googletagmanager.com/gtag/js?id=G-MBZGKNMDWC, the Google tag of the upstream Hugo project (measured on the compose stack: the request leaves the browser, and the beacon that follows to region1.google-analytics.com/g/collect is refused by connect-src). Cause: services.hugo.hugo_environment: production in meta/services.yml makes the theme render its analytics partial with the id from upstream’s hugo.toml, and meta/csp.yml whitelists the tag host. Options: build with another Hugo environment; or pass an empty HUGO_SERVICES_GOOGLEANALYTICS_ID as a build argument and drop the two whitelist entries.

• The search panel of the default source never lists a result: a query logs Connecting to 'https://d1bplzhgyq-dsn.algolia.net/1/indexes/*/queries' violates the following Content Security Policy directive: "connect-src 'self' https://cdn.<domain>" and the list stays empty (measured on the compose stack). Cause: the theme queries the Algolia index of the upstream site from the browser and meta/csp.yml declares no connect-src entry; an allowed request would return links into upstream’s own pages. Options: whitelist the Algolia host under connect-src and accept upstream’s index; or leave the request blocked and remove the search controls from the build.

• Every article ends with Last updated: January 1, 0001 (measured on the compose stack, for example on /functions/strings/contains/). Cause not verified: the theme prints the last modification date of the page, which Hugo takes from the Git history, and the build stage may see none. Options: check whether services/repository/ reaches the builder with its .git directory and whether the builder image carries git; or drop the line for builds without history.