Implementation wise, great direction.

1. The fallback lastmod is misleading.

  scripts/generate-sitemap.mjs:199:
  const fallbackLastmod = latestOverall ?? new Date().toISOString().split("T")[0];
  for (const entry of missingLastmodEntries) {
    entry.lastmod = fallbackLastmod;
  }

If a single post has no modified field, the script assigns it the latest date of any post in the entire
feed. So a 2020 post that's missing modified would get tagged as updated yesterday, which is a false
freshness signal Google will eventually distrust. Better: fall back to the post's own date (publish
date), and only fall back to "today" if both modified AND date are absent. The query needs to add date to
the GraphQL selection.

2. If wp.keploy.io/graphql is down, rate-limited, or returns errors, the workflow fails silently. Add a step
   on if: failure() that posts to Slack/Discord (#qa-alerts or wherever) so you find out the same day
   instead of when Google Search Console starts complaining about a stale sitemap a week later. Use the
   existing Slack webhook if you have one.

3. The hand-rolled JWT signing is fragile.
   .github/workflows/submit-google-sitemap.yml:38–99 is 60 lines of bash + python + openssl to sign a JWT,
   exchange it for an OAuth token, and call the Webmasters API. It works, but a Node.js step using the
   official googleapis package is ~10 lines and dramatically easier to debug:

• run: |
  node -e "
  const {google} = require('googleapis');
  const auth = new google.auth.JWT(
  process.env.GOOGLE_SERVICE_ACCOUNT_EMAIL, null,
  process.env.GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY,
  ['https://www.googleapis.com/auth/webmasters']
  );
  const sc = google.webmasters({version:'v3', auth});
  sc.sitemaps.submit({
  siteUrl: process.env.GOOGLE_SEARCH_CONSOLE_SITE_URL,
  feedpath: process.env.GOOGLE_SITEMAP_URL
  }).then(()=>console.log('submitted'));
  "
  env: { ... }
  Optional, but I'd push for it — fewer moving parts, better error messages.

4. remove the existing next-sitemap automation
5. keep the priority to 0.7
6. No image:image markup in the sitemap. Every blog post has a featured image. Adding image sitemap
   entries (xmlns:image="http://www.google.com/schemas/sitemap-image/0.9") is a free image-search visibility
   boost. ~10 lines of extra code in buildSitemapXml.

Implementation wise, great direction.

1. The fallback lastmod is misleading.

  scripts/generate-sitemap.mjs:199:
  const fallbackLastmod = latestOverall ?? new Date().toISOString().split("T")[0];
  for (const entry of missingLastmodEntries) {
    entry.lastmod = fallbackLastmod;
  }

If a single post has no modified field, the script assigns it the latest date of any post in the entire feed. So a 2020 post that's missing modified would get tagged as updated yesterday, which is a false freshness signal Google will eventually distrust. Better: fall back to the post's own date (publish date), and only fall back to "today" if both modified AND date are absent. The query needs to add date to the GraphQL selection.

2. If wp.keploy.io/graphql is down, rate-limited, or returns errors, the workflow fails silently. Add a step
   on if: failure() that posts to Slack/Discord (#qa-alerts or wherever) so you find out the same day
   instead of when Google Search Console starts complaining about a stale sitemap a week later. Use the
   existing Slack webhook if you have one.
3. The hand-rolled JWT signing is fragile.
   .github/workflows/submit-google-sitemap.yml:38–99 is 60 lines of bash + python + openssl to sign a JWT,
   exchange it for an OAuth token, and call the Webmasters API. It works, but a Node.js step using the
   official googleapis package is ~10 lines and dramatically easier to debug:

• run: |
  node -e "
  const {google} = require('googleapis');
  const auth = new google.auth.JWT(
  process.env.GOOGLE_SERVICE_ACCOUNT_EMAIL, null,
  process.env.GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY,
  ['https://www.googleapis.com/auth/webmasters']
  );
  const sc = google.webmasters({version:'v3', auth});
  sc.sitemaps.submit({
  siteUrl: process.env.GOOGLE_SEARCH_CONSOLE_SITE_URL,
  feedpath: process.env.GOOGLE_SITEMAP_URL
  }).then(()=>console.log('submitted'));
  "
  env: { ... }
  Optional, but I'd push for it — fewer moving parts, better error messages.

4. remove the existing next-sitemap automation
5. keep the priority to 0.7
6. No image:image markup in the sitemap. Every blog post has a featured image. Adding image sitemap
   entries (xmlns:image="http://www.google.com/schemas/sitemap-image/0.9") is a free image-search visibility
   boost. ~10 lines of extra code in buildSitemapXml.

Thanks @nehagup for the review and helping me out to optimise the solution, I have gone through all the points mentioned and addressed them:

1. Fallback lastmod - Removed the batch missingLastmodEntries approach. Each post now resolves modified → date (publish date) → today inline. Added date to the GraphQL selection. latestOverall no longer gets assigned to individual posts - only used for static entries (/blog, category pages).

2. Failure notifications - Acknowledged, skipping for now, will revisit when we have discussed the webhook set up and implementation.

3. Hand-rolled JWT - Replaced the 60-line bash/python/openssl block with the googleapis Node.js package. Added checkout + setup-node + npm install --no-save googleapis. Private key \n normalisation handled inline (key.replace(/\\n/g, '\n')). Validation step kept for clear error messages on missing secrets.

4. next-sitemap - Confirmed it is not in the codebase; nothing to remove.

5. Priority — Updated to 0.70.

6. Image sitemap - Implemented. Added featuredImage { node { sourceUrl altText } } to the GraphQL query. Each post with a featured image gets an <image:image> block; xmlns:image namespace only injected when at least one image is present. Validated against the live WordPress API:

curl -sS -X POST "https://wp.keploy.io/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ posts(first: 50, where: { orderby: { field: MODIFIED, order: DESC } }) { edges { node { slug featuredImage { node { sourceUrl altText } } } } } }"}'

50/50 posts returned absolute https:// sourceUrl values with populated altText - no null images, no relative URLs.