Fix review findings: canonical URL normalization, JSON-LD escaping, ARIA state, CI coverage

[AlexanderWagnerDev]

What changed

Addresses the four review findings (qodo-code-review) posted on #2, which also line up with the SonarCloud quality gate failure on that PR (Reliability B, Security C on new code):

• includes/header.php: normalize $canonicalPath by stripping a trailing /index.php, so pages that don't set $canonicalPath explicitly (docs, legal) emit the same canonical URL whether reached via the directory path or the index.php path.
• includes/header.php: add JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT to the JSON-LD json_encode() call so structured data can't break out of the <script type="application/ld+json"> tag.
• assets/js/main.js: sync the nav toggle button's aria-expanded attribute with the actual open/closed state instead of only toggling a CSS class.
• .github/workflows/site-checks.yml: add /legal/ to the CI smoke-test route list — it's listed in sitemap.xml but wasn't being checked.

Validation

• php -l on the changed PHP file: no syntax errors.
• Ran the site locally with php -S and curled /, /quickstart/, /docs/, /legal/, /guides/: all return 200.
• Confirmed the homepage's <link rel="canonical"> and JSON-LD <script> render correctly after the change.

Base branch is agent/reach-and-seo (the existing open PR #2) so this merges into that PR rather than opening a separate, conflicting change against main.

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: cf945069-4921-485a-8511-5b5659d0d9d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Fix canonical URL normalization, JSON-LD escaping, ARIA state, and CI route coverage

🐞 Bug fix ✨ Enhancement ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Normalize canonical URLs by stripping trailing "/index.php" from inferred request paths.
• Harden JSON-LD output by hex-escaping HTML-sensitive characters in json_encode().
• Sync nav toggle aria-expanded with actual open/closed state and expand CI route coverage.

Diagram

graph TD
  U["Browser"] --> H["includes/header.php"] --> C["Canonical link"] --> U
  H --> J["JSON-LD script"] --> U
  U --> M["assets/js/main.js"] --> A["ARIA expanded"] --> U
  W["GitHub Actions"] --> S["site-checks.yml"] --> R["curl smoke routes"]

  subgraph Legend
    direction LR
    _u["User agent"] ~~~ _code["Code / config"] ~~~ _out["Rendered output"]
  end

Loading

High-Level Assessment

The PR’s approach is the most direct, lowest-risk way to address the stated review/Sonar findings: normalize canonical paths at the source of truth (header.php), use standard JSON_HEX_* flags for safe JSON-in-script embedding, set aria-expanded from real state to ensure accessibility correctness, and align CI smoke routes with sitemap coverage. Considered alternatives (e.g., rewriting URLs at the server/router layer, or moving JSON-LD escaping to a separate helper) would add complexity without improving correctness for this scope.

Files changed (3) +5 / -2

Bug fix (2) +3 / -1

main.jsKeep nav toggle aria-expanded in sync with open state +1/-0

Keep nav toggle aria-expanded in sync with open state

• Updates the click handler to set aria-expanded based on whether the nav has the 'open' class. This ensures assistive technologies receive the correct expanded/collapsed state.

assets/js/main.js

header.phpNormalize canonical path and harden JSON-LD output escaping +2/-1

Normalize canonical path and harden JSON-LD output escaping

• Normalizes inferred canonical paths by stripping a trailing /index.php to avoid duplicate canonical URLs. Adds JSON_HEX_* flags to json_encode for JSON-LD so content cannot prematurely terminate the script tag.

includes/header.php

Other (1) +2 / -1

site-checks.ymlAdd /legal/ to CI smoke-test route list +2/-1

Add /legal/ to CI smoke-test route list

• Extends the curl-based smoke test loop to include the /legal/ path. This better matches sitemap-advertised coverage and prevents regressions for that route.

.github/workflows/site-checks.yml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review