Merge pull request 'fix(seo): keep staging out of the search index' (#111) from fix/staging-noindex into main

Reviewed-on: #111

e2e/tests/journeys.spec.ts

@@ -1695,3 +1695,34 @@ test('a bare /compare is indexable, a parameterised one is not', async ({ page }
     .getAttribute('href');
   expect(canonical).toBe('https://www.schoolcompare.co.uk/compare');
 });
+
+/*
+ * Staging must not be indexable (spec 2026-08-20, W1 hygiene).
+ *
+ * These journeys only ever run against staging — deploy.yml passes
+ * STAGING_BASE_URL, and promote.yml only smoke-polls production without
+ * Playwright — so asserting the noindex header here is safe.
+ */
+test('staging answers noindex, and stays crawlable so the noindex is seen', async ({ page }) => {
+  const res = await page.request.get('/');
+  expect(res.ok()).toBeTruthy();
+
+  const tag = res.headers()['x-robots-tag'];
+  expect(tag, 'staging must send X-Robots-Tag').toBeTruthy();
+  expect(tag).toContain('noindex');
+
+  // The other half, and the reason this is one test rather than two: a
+  // Disallow would stop Google fetching the page at all, so it would never
+  // see the noindex above. The two only work together.
+  const robots = await (await page.request.get('/robots.txt')).text();
+  expect(robots).not.toMatch(/^\s*Disallow:\s*\/\s*$/mi);
+});
+
+test('a school page on staging is noindexed too, not just the homepage', async ({ page }) => {
+  const list = await page.request.get('/api/schools?search=primary&per_page=1');
+  const [first] = (await list.json()).schools ?? [];
+  expect(first, 'no school available').toBeTruthy();
+
+  const res = await page.request.get(`/school/${first.urn}-x`);
+  expect(res.headers()['x-robots-tag']).toContain('noindex');
+});