fix(website): keep extension stars fresh

[benvinegar]

Summary

• refresh extension stars and activity through a first-party Vercel Function
• cache successful responses at the CDN for one hour with stale-while-revalidate
• retain build-time metadata when the live refresh is unavailable
• cover endpoint caching, compact payload parsing, browser updates, and deployment configuration

Validation

• bun run typecheck
• bun run website:check
• bun run website:build
• bun test api/extension-activity.test.ts scripts/generate-docs.test.ts scripts/check-website-links.test.ts scripts/check-extension-catalog.test.ts
• cd website && bunx playwright test tests/extensions-smoke.spec.ts

This PR description was generated by Pi using OpenAI GPT-5.6 Sol

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hunk-web	Ready	Preview	Aug 23, 2026 12:36am

[greptile-apps]

Greptile Summary

The PR adds a first-party Vercel endpoint that retrieves compact GitHub activity, applies shared-cache headers, and refreshes the statically generated extension directory in the browser while retaining build-time metadata as a fallback.

• Extracts shared activity parsing and formatting helpers.
• Adds endpoint, browser, catalog, and deployment-related tests and configuration.
• Updates deployment documentation and CI coverage for the new endpoint.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking configuration-quality issue in the new server function’s direct environment access.

The endpoint and browser refresh paths are defensively implemented and tested, but GITHUB_TOKEN bypasses the repository’s validated environment-access convention.

Files Needing Attention: api/extension-activity.ts

Important Files Changed

Filename	Overview
api/extension-activity.ts	Adds the cached GitHub activity handler; direct process.env access bypasses the required validated environment configuration pattern.
website/src/data/extensionActivity.ts	Adds defensive parsing, compact payload serialization, repository indexing, and activity date formatting shared by server and browser code.
website/src/pages/extensions.astro	Refreshes star and date metadata client-side, updates sorting attributes, and preserves static fallback behavior on endpoint failures.
vercel.json	Includes API changes in deployment detection while retaining the static Astro output configuration.
api/extension-activity.test.ts	Covers successful compact responses, cache headers, upstream failures, and method rejection.
website/tests/extensions-smoke.spec.ts	Covers live activity application and card reordering while keeping other browser tests deterministic through endpoint stubbing.

Sequence Diagram

sequenceDiagram
    participant B as Browser
    participant V as Vercel CDN / Function
    participant G as GitHub API
    B->>B: Render build-time extension metadata
    B->>V: GET /api/extension-activity
    alt Cached response available
        V-->>B: Compact cached activity
    else Cache miss
        V->>G: Search public hunk-extension repositories
        G-->>V: Repository activity
        V-->>B: Compact activity with shared-cache policy
    end
    B->>B: Update stars, dates, and card ordering
    Note over B: On refresh failure, retain build-time metadata

Loading

Prompt To Fix All With AI

### Issue 1
api/extension-activity.ts:15
**Direct environment access bypasses validation**

The new function reads `GITHUB_TOKEN` directly from `process.env`, bypassing the repository’s required Varlock validation and leaving configuration mistakes unchecked until deployment.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(website): keep extension stars fresh" | Re-trigger Greptile}

[greptile-apps]

Direct environment access bypasses validation

The new function reads GITHUB_TOKEN directly from process.env, bypassing the repository’s required Varlock validation and leaving configuration mistakes unchecked until deployment.

Context Used: guidelines.mdc Cursor rule (source)

Prompt To Fix With AI

This is a comment left during a code review.
Path: api/extension-activity.ts
Line: 15

Comment:
**Direct environment access bypasses validation**

The new function reads `GITHUB_TOKEN` directly from `process.env`, bypassing the repository’s required Varlock validation and leaving configuration mistakes unchecked until deployment.

**Context Used:** guidelines.mdc Cursor rule ([source](https://github.com/modem-dev/modem/blob/main/.cursor/rules/guidelines.mdc))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!