fix: release automation, security headers, and doc updates#23
Merged
Conversation
Release automation: - Add workflow_dispatch to ci.yml so CI can be triggered on release-please branches (GITHUB_TOKEN PRs suppress pull_request events; workflow_dispatch is exempt from that suppression) - Parse release-please PR JSON output with jq; use RELEASE_PLEASE_TOKEN to trigger CI, approve PR, and enable auto-merge - Configure Dependabot commit-message prefixes: fix(deps) for npm, chore(ci) for Actions — aligns with release-please changelog config - Update release-please-config: remove unused deps type, rename fix section to 'Bug Fixes & Dependencies' Security: - Add _headers at project root with X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy for all Cloudflare Pages responses - Validate OIDC discovery URLs to https: before rendering as links (safeHref) - Use issuerUrl.href instead of raw issuer string in discovery proxy Fixes: - Add id="input" to textarea (resolves Chrome autofill/form field warning) - Set build.cssCodeSplit: false to resolve CSS preload timing mismatch warning Docs: - Add CHANGELOG.md with v1.0.0 entry - Add conventional commit reference table to CLAUDE.md - Update CLAUDE.md: remove stale @peculiar/x509 note, add hash.ts docs, update OIDC discovery description, prune shipped planned features - Update README.md: add shareable links, light mode, and OIDC Discovery UI feature sections; add hash.ts to project structure; remove shipped items from What's planned - Update SECURITY.md: add shareable links privacy note, document _headers controls
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
workflow_dispatchtrigger on CI so release-please PRs can be explicitly triggered (GITHUB_TOKEN PRs suppresspull_requestevents); parse release-please JSON output withjq; useRELEASE_PLEASE_TOKENto trigger CI, approve, and enable auto-merge on release PRs; Dependabot conventional commit prefixes aligned with release-please config_headersat project root deploysX-Content-Type-Options,X-Frame-Options: DENY,Referrer-Policy: no-referrer, andPermissions-Policyvia Cloudflare PagessafeHref()helper validates OIDC discovery endpoint URLs tohttps:before rendering as links; useissuerUrl.hrefin the discovery proxy instead of the raw input stringid="input"on textarea resolves Chrome autofill warning;build.cssCodeSplit: falseresolves CSS preload timing mismatch in DevTools consoleDocs & changelog
CHANGELOG.mdcreated with v1.0.0 entry (formatted for release-please to append to)CLAUDE.md: conventional commit reference table,hash.tsdocs, stale notes removed, planned features pruned to reflect what's shippedREADME.md: shareable links, light mode, and OIDC Discovery UI added to Features; project structure updated; shipped items removed from What's plannedSECURITY.md: shareable links privacy note;_headerscontrols documentedTest plan
_headerspresent in Cloudflare build output