fix: address unresolved review comments from PR #398

Dockerfile

@@ -12,7 +12,7 @@ FROM ${NODE_IMAGE} AS base
 # Install wget and update npm to version 11 (pinned by hash)
 RUN apk add --no-cache wget && \
     wget -O npm.tgz https://registry.npmjs.org/npm/-/npm-11.10.0.tgz && \
-    echo "dc0e65832b94fb48b8746c8ed43e1d2d2c9b0726  npm.tgz" | sha1sum -c - && \
+    echo "43c653384c39617756846ad405705061a78fb6bbddb2ced57ab79fb92e8af2a7  npm.tgz" | sha256sum -c - && \
     npm install -g npm.tgz && \
     rm npm.tgz && \
     rm -rf /var/cache/apk/*
@@ -83,6 +83,7 @@ ENV SENTRY_PROJECT=${SENTRY_PROJECT}
 ENV NEXT_PUBLIC_SENTRY_DSN=${NEXT_PUBLIC_SENTRY_DSN}
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV NEXT_PRIVATE_BUILD_WORKER_COUNT=1
+ENV NODE_OPTIONS="--max-old-space-size=2560"
 
 WORKDIR /app
 

src/app/(public)/build-info/page.tsx

@@ -277,12 +277,12 @@ export default function BuildInfoPage() {
                   <p className="text-sm text-muted-foreground mb-4">
                     View the source code and contribution history
                   </p>
-                  <Link href={`https://github.com/${meta.github_repo}`} target="_blank">
+                  <a href={`https://github.com/${meta.github_repo}`} target="_blank" rel="noopener noreferrer">
                     <Button variant="outline" size="sm" className="w-full">
                       View on GitHub
                       <ExternalLink className="w-3 h-3 ml-2" />
                     </Button>
-                  </Link>
+                  </a>
                 </Card>
               )}
 
@@ -293,15 +293,16 @@ export default function BuildInfoPage() {
                   <p className="text-sm text-muted-foreground mb-4">
                     View the CI/CD pipeline logs for this build
                   </p>
-                  <Link
+                  <a
                     href={`https://github.com/${meta.github_repo}/actions/runs/${meta.github_run_id}`}
                     target="_blank"
+                    rel="noopener noreferrer"
                   >
                     <Button variant="outline" size="sm" className="w-full">
                       View Build #{meta.github_run_number || meta.build_id}
                       <ExternalLink className="w-3 h-3 ml-2" />
                     </Button>
-                  </Link>
+                  </a>
                 </Card>
               )}
 
@@ -312,15 +313,16 @@ export default function BuildInfoPage() {
                   <p className="text-sm text-muted-foreground mb-4">
                     SLSA Level 3 cryptographic proofs and signatures
                   </p>
-                  <Link
+                  <a
                     href={`https://github.com/${meta.github_repo}/attestations`}
                     target="_blank"
+                    rel="noopener noreferrer"
                   >
                     <Button variant="outline" size="sm" className="w-full">
                       View Attestations
                       <ExternalLink className="w-3 h-3 ml-2" />
                     </Button>
-                  </Link>
+                  </a>
                 </Card>
               )}
 
@@ -331,15 +333,16 @@ export default function BuildInfoPage() {
                   <p className="text-sm text-muted-foreground mb-4">
                     OpenSSF security best practices compliance
                   </p>
-                  <Link
+                  <a
                     href={`https://scorecard.dev/viewer/?uri=github.com/${meta.github_repo}`}
                     target="_blank"
+                    rel="noopener noreferrer"
                   >
                     <Button variant="outline" size="sm" className="w-full">
                       View Scorecard
                       <ExternalLink className="w-3 h-3 ml-2" />
                     </Button>
-                  </Link>
+                  </a>
                 </Card>
               )}
             </div>

src/app/__tests__/sitemap.test.ts

@@ -112,7 +112,7 @@ describe("sitemap.xml", () => {
     expect(homepage.priority).toBeGreaterThan(others[0].priority || 0);
   });
 
-  it("should have different priorities for different page types", () => {
+  it("should have priority hierarchy: homepage > public pages > build-info", () => {
     const urls = sitemap();
     const homepage = urls[0];
     const publicPages = urls.slice(1, 4); // login, contact, legal

src/app/api/provenance/route.ts

@@ -11,11 +11,11 @@ export function GET() {
   const buildTimestamp = process.env.BUILD_TIMESTAMP ?? new Date().toISOString();
   const auditStatus = process.env.AUDIT_STATUS ?? "UNKNOWN";
   const signatureStatus = process.env.SIGNATURE_STATUS ?? "UNSIGNED";
-  const imageDigest = process.env.IMAGE_DIGEST ?? commitSha;
+  const imageDigest = process.env.IMAGE_DIGEST ?? commitSha; // IMAGE_DIGEST is post-build only, fallback to commit SHA
 
   return NextResponse.json(
     {
-      commit: commitSha,
+      commit: commitSha, // Legacy field for backward compatibility
       commit_sha: commitSha,
       build_id: githubRunId || commitSha,
       github_run_id: githubRunId,