Fix `/output/` URL leak for blog posts with version numbers in slug

[kevinjqliu]

Problem

Some blog post URLs redirect through an internal /output/ path that should never be exposed to users.

Working URLs (slugs without dots):

• https://datafusion.apache.org/blog/2026/03/31/writing-table-providers → 301 → /blog/2026/03/31/writing-table-providers/ ✅

Broken URLs (slugs with version numbers):

• https://datafusion.apache.org/blog/2026/04/18/datafusion-comet-0.15.0 → 301 → /blog/output/2026/04/18/datafusion-comet-0.15.0/ ❌
• https://datafusion.apache.org/blog/2026/04/02/datafusion-53.0.0 → 301 → /blog/output/2026/04/02/datafusion-53.0.0/ ❌
• https://datafusion.apache.org/blog/2024/07/24/datafusion-40.0.0 → 301 → /blog/output/2024/07/24/datafusion-40.0.0/ ❌

Every blog post with a version number in its slug (e.g. datafusion-comet-0.15.0) is affected. The /output/ URL still serves the page, but is not the canonical URL and causes subtle issues — for example, giscus CSP was not applying correctly on the /output/ path (see #80 (comment)).

Root Cause

There is a mismatch between publish-site.yml and .asf.yaml:

• .asf.yaml on asf-site declares subdir: blog, telling ASF infrastructure to serve content from a blog/ subdirectory.
• publish-site.yml does not set output: 'blog', so the pelican action defaults to output: 'output', putting built content into output/ instead of blog/.

# .asf.yaml (expects blog/)
publish:
  whoami: asf-site
  subdir: blog

# publish-site.yml (produces output/)
- uses: apache/infrastructure-actions/pelican@main
  with:
    destination: 'asf-site'
    gfm: 'false'
    # output: 'blog'   <-- MISSING

The staging workflow (stage-site.yml) already has output: 'blog' and works correctly.

To bridge this mismatch, .htaccess on the asf-site branch has rewrite rules that internally map requests from blog/ to output/:

RewriteCond %{REQUEST_URI} !/output/
RewriteRule ^(.*)$ output/$1 [L]

These rules also add a trailing-slash redirect for extensionless URLs, but skip URLs that "look like files":

RewriteCond %1 !\.[^./]+$

The regex \.[^./]+$ matches any dot followed by non-dot/non-slash characters at the end of the URL. This incorrectly matches .0 in version-number slugs like datafusion-comet-0.15.0, causing the trailing-slash redirect to be skipped. Apache's mod_dir then adds the trailing slash itself, but exposes the internal output/ prefix in the redirect Location header.

Fix

Add output: 'blog' to publish-site.yml to match stage-site.yml:

- uses: apache/infrastructure-actions/pelican@main
  with:
    destination: 'asf-site'
    gfm: 'false'
    output: 'blog'

This puts build output into blog/ on the asf-site branch, matching what .asf.yaml expects. The .htaccess rewrite rules become unnecessary.

Follow-up (after deploy)

After the first successful deploy with this fix, a separate PR to the asf-site branch should:

1. Remove the stale output/ directory (all content will now be in blog/).
2. Simplify .htaccess to remove the rewrite rules, keeping only the CSP directive:

SetEnv CSP_PROJECT_DOMAINS "https://giscus.app"

[kevinjqliu]

Opened #179, which adds output: 'blog' to publish-site.yml so build output goes to blog/ instead of output/, matching what .asf.yaml expects. This eliminates the need for the .htaccess rewrite rules that were causing the /output/ redirect.

Once #179 is merged and deployed, I'll verify that blog/ and output/ have identical content on the asf-site branch.

After that, we can merge #180 (targeting the asf-site branch), which removes the stale output/ directory and simplifies .htaccess to just the CSP directive.

After both PRs land, blog posts with version numbers in their slugs should redirect correctly — e.g. datafusion-53.0.0 will go to https://datafusion.apache.org/blog/2026/04/02/datafusion-53.0.0/ instead of https://datafusion.apache.org/blog/output/2026/04/02/datafusion-53.0.0/.

[kevinjqliu]

We reverted both #179 and #180. The deployment pattern for this blog site requires URL redirection.

With the reverts in place, Giscus now loads correctly on the redirected URLs. That was the actual user-facing problem.
I'm not entirely sure why Giscus failed to load before and works now after the reverts. The .htaccess and output/ content should be the same as they were previously, so the difference isn't obvious. If anyone has insight, I'd be curious to hear it. (Perhaps it was cached?)

A note on why the redirect is needed (for future reference):
The https://datafusion.apache.org/ domain is shared by both the main site and the blog site. The blog site is mounted at https://datafusion.apache.org/blog/. The publish workflow must publish into a subdirectory (output/) on the deploy branch so the blog content lives in https://datafusion.apache.org/blog/output/.
We can't write to the branch root, because the ASF pelican action runs rm -rf ${output} before copying, which would destroy the other files there (.htaccess, .asf.yaml, etc.).
As a result, all blog content lives in output/ on the asf-site branch, and .htaccess rewrites are required to serve it under the user-facing https://datafusion.apache.org/blog/... URLs.

Closing this out. No further fix planned.