feat: embed git hash in website and verify after CI deploy

- website/layouts/_partials/extend_head.html: injects <meta name="x-version">
  using HUGO_PARAMS_GITVERSION (set by Taskfile at build time)
- Taskfile: website-build sets HUGO_PARAMS_GITVERSION=<short HEAD>;
  new website-verify task runs scripts/website-verify.sh
- scripts/website-verify.sh: fetches homepage, retries 6x/10s, checks
  that the deployed version hash matches HEAD
- website.yml: Verify step after Deploy; scripts/website-verify.sh added
  to path trigger

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/website.yml

@@ -5,6 +5,7 @@ on:
     branches: [main]
     paths:
       - 'website/**'
+      - 'scripts/website-verify.sh'
       - '.forgejo/workflows/website.yml'
 
 jobs:
@@ -40,3 +41,6 @@ jobs:
           SSH_USER: ${{ secrets.WEBSITE_SSH_USER }}
           SSH_HOST: ${{ secrets.WEBSITE_SSH_HOST }}
         run: nix develop --command task website-deploy
+
+      - name: Verify
+        run: nix develop --command task website-verify

Taskfile.yml

@@ -329,10 +329,18 @@ tasks:
       - nix develop --command hugo server --source website -D
 
   website-build:
-    desc: Build the static website
+    desc: Build the static website (embeds current git hash via HUGO_PARAMS_GITVERSION)
+    env:
+      HUGO_PARAMS_GITVERSION:
+        sh: git rev-parse --short HEAD
     cmds:
       - nix develop --command hugo --source website --minify
 
+  website-verify:
+    desc: Check that the deployed site serves the current git version
+    cmds:
+      - scripts/website-verify.sh
+
   website-deploy:
     desc: Deploy the website via rsync to public_html
     deps: [website-build]

scripts/website-verify.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION=$(git rev-parse --short HEAD)
+URL="https://sharedinbox.de/"
+
+echo "Checking that version ${VERSION} is live at ${URL} ..."
+for i in $(seq 1 6); do
+    if curl -sf "${URL}" | grep -q "x-version.*${VERSION}"; then
+        echo "OK: version ${VERSION} is live."
+        exit 0
+    fi
+    echo "Not yet (attempt ${i}/6); waiting 10s ..."
+    sleep 10
+done
+
+echo "FAIL: version ${VERSION} not found at ${URL}"
+exit 1

website/layouts/_partials/extend_head.html

@@ -0,0 +1,3 @@
+{{- with site.Params.gitversion -}}
+<meta name="x-version" content="{{ . }}">
+{{- end -}}