[bong-water-water-bong]

Adds the Docs7 analytics script to every page, next to GoatCounter:

<script defer src="https://context7.com/docs7-analytics.js" data-site="…"></script>

• It's on only when the repository variable DOCS7_SITE holds the Docs7 site id. The variable is set to f172a149-d085-45bc-8c58-ae0de677b0bf.
• The id is checked as a UUID, like the other site variables.
• A local build with the variable renders the tag on all 26 pages, and GoatCounter is unchanged.

🤖 Generated with Claude Code

[context7]

Docs7 for 1bit-monster/engine

Result	Status	Action
Deployment	➖ Not used	—
Content review	➖ Did not run. This site has no agent runs available this month. Wait for the monthly reset or check your Docs7 plan.	—

Commit 675de3c

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Missing Input Validation for DOCS7_SITE The DOCS7_SITE environment variable is validated as a UUID using a regular expression, but the validation does not ensure that the UUID is in the correct format (version 4). While the regex checks for the basic structure of a UUID, it does not verify that the UUID is a valid version 4 UUID, which could lead to unexpected behavior if an invalid UUID is passed. This could be a potential security or correctness issue if the analytics script is misconfigured. if site: if not re.fullmatch(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}", site): sys.exit(f"DOCS7_SITE must be the Docs7 site id (a UUID), not {site!r}") out.append(f'<script defer src="https://context7.com/docs7-analytics.js" data-site="{site}"></script>') Potential Security Risk from DOCS7_SITE The DOCS7_SITE variable is used directly in the HTML output without any additional sanitization or encoding. If the UUID contains unexpected characters or is malformed, it could potentially lead to XSS vulnerabilities or other security issues. Although the validation ensures it's a UUID, it's still important to ensure that the value is properly escaped when inserted into the HTML. out.append(f'<script defer src="https://context7.com/docs7-analytics.js" data-site="{site}"></script>')