Repository navigation
chore: website modernization phase 1 (SRI, no analytics, Dependabot, CodeQL) - #29
Merged
Merged
Conversation
Maintainer decision: move the site to Cloudflare Workers static assets after modernizing it. Spec, plan and tasks in five phases; roadmap updated. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Spec 005 T1 (AC1, AC2). Fails today: Tailwind browser floats on @4, Font Awesome has no integrity, reCAPTCHA loads with a placeholder key, and both head includes carry the UA snippet. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Spec 005 T2. Tailwind browser is pinned to 4.3.3 (what @4 already resolved to, so styles are unchanged) using the published dist file, whose hash is stable across CDNs; Font Awesome 6.4.0 gets its integrity hash. The UA snippet (a placeholder id, and Universal Analytics is retired) is removed from both head includes. reCAPTCHA is turned off: it loaded on 509 pages with a placeholder site key for Staticman forms that are hidden until contribute ships. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Spec 005 T3. Weekly grouped updates for gems, root and e2e packages, Actions and the content submodules; CodeQL security-and-quality for JavaScript, Ruby and the workflows themselves. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Spec 005 T4 (approved part). 5,135 installed gem files (73.5 MB) were committed despite the .gitignore entry; they leave the index only, local installs keep working. History is not rewritten. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Deploying iplibrary-website with
|
| Latest commit: |
5bd28a9
|
| Status: | 🚫 Build failed. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Member
Author
|
@codex full review |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Spec 005 (website modernization) Phase 1 — safety and hygiene — plus the spec itself and ADR 0003 (deploy on Cloudflare Workers static assets).
<script>/stylesheet in built pages has an exact version and anintegrityhash (AC1); no Google Analytics in templates or pages (AC2)@4already served, so no visual change) via the publisheddistfile, whose SRI hash is stable across CDNs; Font Awesome 6.4.0 with SRI; placeholder Universal Analytics removed; reCAPTCHA off (it loaded on 509 pages with a placeholder key for hidden Staticman forms)vendor/bundleuntracked: 5,135 files / 73.5 MB; the rest of the deletion list awaits maintainer approvalELI5
The site now only loads outside code it can verify byte by byte, stops sending visits to Google, and the repository no longer carries 73 MB of installed libraries.
Tests
rake test: 15 runs, 58 assertions, 0 failures (2 new)yarn test:e2e: 104 passed, 2 skippedBuild/Security Checksjobs fail on master too (npm ciwithout a lockfile); replaced in Phase 2 (T6)AI disclosure
🤖 Generated with Claude Code