Add the getsysperf.com landing page and deploy it to Cloudflare Pages #3

Merged

jacboy merged 4 commits from claude/lucid-planck-v4zwtb into master

2026-11-09 15:25:23 +00:00

jacboy commented

2026-11-09 14:03:33 +00:00

(Migrated from github.com)

A static landing page for getsysperf.com, plus a GitHub Actions workflow that deploys it to the Cloudflare Pages project sysperf. Page and script (/bench) always come from the same commit of this repository.

Landing page

`site/index.html`, `style.css`, `copy.js`, `favicon.svg`

Hero: the one-liner curl -fsSL https://getsysperf.com/bench | bash, with a curl/wget switch and a copy button.
What it measures: system, disk, network and CPU.
Example output from a real run on Debian 13.
Options: GEEKBENCH=7, with download size, requirements and the upload notice.
Before you run it: a download-read-run command, the SHA-256 of the current script (also at /bench.sha256), what the script changes on the system, and which hosts it contacts.
Privacy: no external fonts, scripts, analytics or cookies.
Layout: light and dark theme, works at phone width, and commands wrap instead of being cut off.

`site/build.sh`

Builds into dist/. It copies the repository's own bench to /bench, writes /bench.sha256, and fills in SYSPERF_VERSION and the checksum.
SITE_URL (optional, default https://getsysperf.com) sets where the commands on the page point. Only plain https://host values are accepted.
Fails if bench has a syntax error or no version.

`site/_headers`

HSTS, a strict Content-Security-Policy, Referrer-Policy: no-referrer and a restrictive Permissions-Policy. /bench and /bench.sha256 are served as text/plain with Cache-Control: no-cache.

`site/README.md`

Local preview, releasing, how the site is hosted, and securing the domain.

Deployment: `.github/workflows/deploy.yml`

When: on push to master that changes bench, site/ or the workflow, and manually under Actions → Deploy site → Run workflow.
What it does:
1. Builds the site.
2. Uploads it to the Pages project sysperf with wrangler pages deploy, using Wrangler pinned to 4.159.0 via npx and no third-party action.
3. Verifies that https://sysperf.pages.dev/bench is byte-identical to the build, that the page shows the new version, and that the served script parses. https://getsysperf.com is checked too, but only warns while the custom domain is being set up.
Credentials: one repository secret, CLOUDFLARE_API_TOKEN, with only Account · Cloudflare Pages · Edit. The account ID isn't secret and lives in the workflow.
Hardening:
- read-only GITHUB_TOKEN
- checkout without persisted credentials
- actions pinned to full commit hashes
- one deployment at a time, and a 10-minute timeout

Cloudflare state (set up outside this PR)

Pages project sysperf created (Direct Upload, production branch master).
Custom domain getsysperf.com added to the project. It still needs the DNS record getsysperf.com CNAME sysperf.pages.dev (proxied) before it can activate.

Testing

Build:
- The build leaves no placeholders, and the checksum verifies.
- /bench is identical to bench.
- Invalid SITE_URL values are rejected.
Page: Chromium at 1280 px and 375 px, light and dark, with the same CSP: no overflow, no console errors or CSP violations. The copy buttons copy the exact commands.
Workflow: actionlint 1.7.12 passes, including shellcheck on the run steps.
Not testable here: the actual upload. My sandbox's HTTPS proxy replaces the Authorization header that Pages' asset upload needs, so the first real deployment is the workflow run after merging.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WFUVi2gu5nYSuZeyRWAGiM

A static landing page for `getsysperf.com`, plus a GitHub Actions workflow that deploys it to the Cloudflare Pages project `sysperf`. Page and script (`/bench`) always come from the same commit of this repository. ## Landing page ### `site/index.html`, `style.css`, `copy.js`, `favicon.svg` - **Hero:** the one-liner `curl -fsSL https://getsysperf.com/bench | bash`, with a curl/wget switch and a copy button. - **What it measures:** system, disk, network and CPU. - **Example output** from a real run on Debian 13. - **Options:** `GEEKBENCH=7`, with download size, requirements and the upload notice. - **Before you run it:** a download-read-run command, the **SHA-256 of the current script** (also at `/bench.sha256`), what the script changes on the system, and which hosts it contacts. - **Privacy:** no external fonts, scripts, analytics or cookies. - **Layout:** light and dark theme, works at phone width, and commands wrap instead of being cut off. ### `site/build.sh` - Builds into `dist/`. It copies the repository's own `bench` to `/bench`, writes `/bench.sha256`, and fills in `SYSPERF_VERSION` and the checksum. - `SITE_URL` (optional, default `https://getsysperf.com`) sets where the commands on the page point. Only plain `https://host` values are accepted. - Fails if `bench` has a syntax error or no version. ### `site/_headers` HSTS, a strict Content-Security-Policy, `Referrer-Policy: no-referrer` and a restrictive `Permissions-Policy`. `/bench` and `/bench.sha256` are served as `text/plain` with `Cache-Control: no-cache`. ### `site/README.md` Local preview, releasing, how the site is hosted, and securing the domain. ## Deployment: `.github/workflows/deploy.yml` - **When:** on push to `master` that changes `bench`, `site/` or the workflow, and manually under *Actions → Deploy site → Run workflow*. - **What it does:** 1. Builds the site. 2. Uploads it to the Pages project `sysperf` with `wrangler pages deploy`, using Wrangler pinned to 4.159.0 via `npx` and no third-party action. 3. **Verifies** that `https://sysperf.pages.dev/bench` is byte-identical to the build, that the page shows the new version, and that the served script parses. `https://getsysperf.com` is checked too, but only warns while the custom domain is being set up. - **Credentials:** one repository secret, `CLOUDFLARE_API_TOKEN`, with only *Account · Cloudflare Pages · Edit*. The account ID isn't secret and lives in the workflow. - **Hardening:** - read-only `GITHUB_TOKEN` - checkout without persisted credentials - actions pinned to full commit hashes - one deployment at a time, and a 10-minute timeout ## Cloudflare state (set up outside this PR) - Pages project `sysperf` created (Direct Upload, production branch `master`). - Custom domain `getsysperf.com` added to the project. It still needs the DNS record `getsysperf.com CNAME sysperf.pages.dev` (proxied) before it can activate. ## Testing - **Build:** - The build leaves no placeholders, and the checksum verifies. - `/bench` is identical to `bench`. - Invalid `SITE_URL` values are rejected. - **Page:** Chromium at 1280 px and 375 px, light and dark, with the same CSP: no overflow, no console errors or CSP violations. The copy buttons copy the exact commands. - **Workflow:** `actionlint` 1.7.12 passes, including shellcheck on the run steps. - **Not testable here:** the actual upload. My sandbox's HTTPS proxy replaces the `Authorization` header that Pages' asset upload needs, so the first real deployment is the workflow run after merging. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01WFUVi2gu5nYSuZeyRWAGiM