From 5db79bed3b684172f500c9b7b5aa09f853ebc959 Mon Sep 17 00:00:00 2001
From: jsshin2022 <59598545+jsshin2022@users.noreply.github.com>
Date: Sat, 24 Oct 2026 04:36:32 +0000
Subject: [PATCH 1/3] Use the hub's own GA4 property and track visits across
team sites
- ga.js configures only G-C5V0X2SGD3, passes page_location so GA keeps
incoming campaigns, then drops utm_* from the address bar.
- Links to the team's other sites on this domain get
utm_source=hub&utm_medium=referral&utm_campaign=crosslink and the
spot they were clicked from, open in the same tab unless a new tab
was asked for, and send webbook_click or team_site_click.
- Hub pages (game, lab, builders, badges) are not treated as team sites.
---
assets/js/ga.js | 35 ++++++++++++++++++++++-------------
assets/js/track.js | 40 ++++++++++++++++++++++++++++++++++++++++
2 files changed, 62 insertions(+), 13 deletions(-)
diff --git a/assets/js/ga.js b/assets/js/ga.js
index 4f010a0..4c016e0 100644
--- a/assets/js/ga.js
+++ b/assets/js/ga.js
@@ -1,15 +1,24 @@
-/* Google Analytics 4 for every page of the hub. The first ID is the hub's property;
- the second is the tag the web book already uses, kept so visits can be followed
- across both sites until one property is chosen. Local previews are not counted. */
+/* Google Analytics 4 for every page of the hub: the hub's own property. Local previews are not
+ counted. Incoming utm_* (from shared links or other team sites) reach GA through page_location
+ and are then removed from the address bar so the URL people copy stays clean. */
(() => {
- const IDS = ["G-C5V0X2SGD3", "G-BEBVKYH8HL"];
- if (location.hostname !== "causalinferencelab.github.io") return;
- const s = document.createElement("script");
- s.async = true;
- s.src = `https://www.googletagmanager.com/gtag/js?id=${IDS[0]}`;
- document.head.appendChild(s);
- window.dataLayer = window.dataLayer || [];
- window.gtag = function gtag() { window.dataLayer.push(arguments); };
- window.gtag("js", new Date());
- IDS.forEach((id) => window.gtag("config", id));
+ const ID = "G-C5V0X2SGD3";
+ if (location.hostname === "causalinferencelab.github.io") {
+ const s = document.createElement("script");
+ s.async = true;
+ s.src = `https://www.googletagmanager.com/gtag/js?id=${ID}`;
+ document.head.appendChild(s);
+ window.dataLayer = window.dataLayer || [];
+ window.gtag = function gtag() { window.dataLayer.push(arguments); };
+ window.gtag("js", new Date());
+ window.gtag("config", ID, { page_location: location.href });
+ }
+ try {
+ const u = new URL(location.href);
+ const drop = [...u.searchParams.keys()].filter((k) => k.startsWith("utm_"));
+ if (drop.length) {
+ drop.forEach((k) => u.searchParams.delete(k));
+ history.replaceState(history.state, "", u.pathname + u.search + u.hash);
+ }
+ } catch (e) { /* old browsers keep the URL as it is */ }
})();
diff --git a/assets/js/track.js b/assets/js/track.js
index e0cf985..08d3aeb 100644
--- a/assets/js/track.js
+++ b/assets/js/track.js
@@ -41,3 +41,43 @@
if (ok && b.dataset.share) window.hubTrack("share", { content: b.dataset.share, method: "copy" });
});
})();
+
+/* Links to the team's other sites on this domain (the web book, causal-studio, ccwr, ...): add utm_*
+ so that site's GA sees the visit came from the hub and from which spot, open them in the same tab
+ unless the reader asked for a new one, and send webbook_click or team_site_click. */
+(() => {
+ "use strict";
+ const HUB_PATHS = /^\/(?:$|index\.html$|article\.html$|404\.html$|game\.html$|lab\.html$|assets\/|data\/|articles\/|builders\/|badges\/)/;
+ const WEBBOOK = "Causal-Inference-with-Python";
+ const SPOTS = [
+ ["#featured", "featured"], [".partner", "partner"], ["#station-dialog", "station"], ["#daily", "daily"],
+ ["#shelf, #week, .spot", "curriculum"], [".gm", "game"], [".lab", "lab"], [".bp", "builder_page"],
+ [".reader, .prose", "article"], [".site-footer", "footer"], [".banner", "banner"]
+ ];
+ function teamSite(a) {
+ let u;
+ try { u = new URL(a.href, location.href); } catch (e) { return null; }
+ if (u.origin !== location.origin || HUB_PATHS.test(u.pathname)) return null;
+ const site = u.pathname.split("/")[1];
+ return site ? { url: u, site } : null;
+ }
+ const placement = (a) => (SPOTS.find(([sel]) => a.closest(sel)) || [null, "other"])[1];
+ function decorate(e) {
+ const a = e.target.closest && e.target.closest("a[href]");
+ if (!a) return;
+ const t = teamSite(a);
+ if (!t) return;
+ const where = placement(a), u = t.url;
+ if (!u.searchParams.has("utm_source")) {
+ u.searchParams.set("utm_source", "hub");
+ u.searchParams.set("utm_medium", "referral");
+ u.searchParams.set("utm_campaign", "crosslink");
+ u.searchParams.set("utm_content", where);
+ a.href = u.toString();
+ }
+ if (e.type === "click" && e.button === 0 && !e.metaKey && !e.ctrlKey && !e.shiftKey && !e.altKey) a.removeAttribute("target");
+ window.hubTrack(t.site === WEBBOOK ? "webbook_click" : "team_site_click", { site: t.site, placement: where, link_url: u.origin + u.pathname });
+ }
+ document.addEventListener("click", decorate, true);
+ document.addEventListener("auxclick", decorate, true);
+})();
From 35ecb8c3bd1c8f02406a96a75d6fca2b80c88d7b Mon Sep 17 00:00:00 2001
From: jsshin2022 <59598545+jsshin2022@users.noreply.github.com>
Date: Sat, 24 Oct 2026 04:49:00 +0000
Subject: [PATCH 2/3] Harden the site against unsafe data and third-party
scripts
- Articles: markdown is rendered through DOMPurify; marked and DOMPurify
are served from assets/vendor instead of a CDN.
- scripts/check_data.py replaces the JSON syntax check in the deploy
workflow: plain-token ids, integer counts, valid slugs, and only
http(s) or site-relative links.
- Builder pages: invalid slugs stop the build; every interpolated value
is escaped; LinkedIn and record links must be http(s); no inline
onerror on avatars.
- Hub: data is cleaned on load (links, ids, counts), dates are escaped,
stored streak values are read as numbers, and a malformed #station=
link no longer stops the page from starting.
- Content-Security-Policy meta on every page; Pretendard from the npm
path with SRI.
- GA config turns off Google signals and ad personalization; privacy
copy matches what is sent.
- Workflow: actions pinned to commits, checkout without persisted
credentials, stats push with an explicit token; update_stats.py only
calls api.github.com and drops Authorization on cross-host redirects.
- Remove the empty .github/workflows/cd file.
---
.github/workflows/cd | 0
.github/workflows/deploy.yml | 12 ++-
404.html | 3 +-
CONTRIBUTING.md | 2 +
article.html | 6 +-
assets/js/article.js | 9 +-
assets/js/ga.js | 2 +-
assets/js/game.js | 3 +-
assets/js/hub.js | 40 ++++++--
assets/js/passport.js | 3 +-
assets/js/track.js | 2 +
assets/vendor/marked-12.0.2.min.js | 6 ++
assets/vendor/purify-3.4.16.min.js | 7 ++
game.html | 3 +-
index.html | 3 +-
lab.html | 3 +-
scripts/build_builders.py | 52 +++++++---
scripts/builder_cards.py | 3 +
scripts/check_data.py | 159 +++++++++++++++++++++++++++++
scripts/update_stats.py | 18 +++-
20 files changed, 296 insertions(+), 40 deletions(-)
delete mode 100644 .github/workflows/cd
create mode 100644 assets/vendor/marked-12.0.2.min.js
create mode 100644 assets/vendor/purify-3.4.16.min.js
create mode 100644 scripts/check_data.py
diff --git a/.github/workflows/cd b/.github/workflows/cd
deleted file mode 100644
index e69de29..0000000
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 65b1ae2..82a1090 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -18,7 +18,10 @@ jobs:
deploy:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ # Actions are pinned to commits; the token is not left in .git/config for later steps.
+ - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+ with:
+ persist-credentials: false
- name: Refresh GitHub stats
if: github.event_name != 'push'
@@ -31,12 +34,11 @@ jobs:
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git add data/stats.json
git commit -m "Update GitHub stats"
- git push
+ git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:main
fi
- name: Check data files
- run: |
- for f in data/*.json; do python3 -m json.tool "$f" > /dev/null || { echo "Invalid JSON: $f"; exit 1; }; done
+ run: python3 scripts/check_data.py
- name: Build Builder pages and badges
run: python3 scripts/build_builders.py
@@ -47,7 +49,7 @@ jobs:
cp -r index.html article.html game.html lab.html 404.html .nojekyll assets data articles builders badges _site/
- name: Publish to gh-pages
- uses: peaceiris/actions-gh-pages@v4
+ uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
publish_dir: ./_site
diff --git a/404.html b/404.html
index 18deca6..bfcb0ad 100644
--- a/404.html
+++ b/404.html
@@ -2,11 +2,12 @@
+
페이지를 찾을 수 없습니다 | Causal Inference Hub
-
+
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 49ddb49..ed755fb 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,6 +9,8 @@
## 내용 더하기
+PR을 올리기 전에 `python3 scripts/check_data.py`를 실행해 주세요. 배포 워크플로도 같은 검사를 하며, 실패하면 배포하지 않습니다. 링크는 https(또는 http)나 사이트 안의 경로만, id는 영문·숫자·하이픈만, 기수·인원은 정수만 허용합니다. 글(`articles/*.md`)의 HTML은 화면에 그릴 때 정리(sanitize)되어 스크립트가 실행되지 않습니다.
+
사이트는 빌드 도구 없이 `data/` 폴더의 JSON 파일을 읽어 그립니다. 대부분의 수정은 파일 하나를 고치는 PR이면 됩니다.
| 파일 | 고치는 경우 |
diff --git a/article.html b/article.html
index a88a677..966a055 100644
--- a/article.html
+++ b/article.html
@@ -2,12 +2,13 @@
+
읽을거리 | Causal Inference Hub
-
+
@@ -56,7 +57,8 @@
}.png?size=160)
' if gh else ""
+ img = f'