[TagRenderer] Dispatch a RenderAssetTagEvent before rendering each tag

Author: Kocal

CHANGELOG.md

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## 0.7.0
+
+- Add the `RenderAssetTagEvent`, dispatched before each rendered `<script>`/`<link>` (including the injected dev client and React preamble), so listeners can add, change or remove attributes such as a CSP nonce
+
 ## 0.6.0
 
 - Add a per-call `attributes` argument to the `reprise_entry_script_tags()` and `reprise_entry_link_tags()` Twig functions

README.md

@@ -35,6 +35,7 @@ Symfony Reprise covers only the Symfony-side glue the bundlers leave out:
 - 🧩 **Symfony UX / Stimulus**: registers `controllers.json` and local controllers, eager or lazy
 - 🌐 **CDN support**: serve built assets from an absolute `publicPath`
 - 🛡️ **Subresource Integrity**: SRI hashes in `entrypoints.json`
+- 🔐 **Customizable tag attributes**: `RenderAssetTagEvent` lets listeners add, change or remove attributes on every rendered tag (e.g. a CSP nonce)
 
 Vite and Rsbuild already handle **Sass/Less/PostCSS**, **TypeScript**, **JSX/Vue/Svelte**, **code splitting**, **content hashing**, **source maps**, **minification** and **HMR** on their own, so Symfony Reprise does not reimplement any of that.
 

composer.json

@@ -17,6 +17,7 @@
     "require": {
         "php": ">=8.4",
         "symfony/asset": "^7.4|^8.0",
+        "symfony/event-dispatcher-contracts": "^3",
         "twig/twig": "^3.0"
     },
     "require-dev": {

doc/index.rst

@@ -30,6 +30,7 @@ reimplement any of that. It covers only the Symfony-side glue the bundlers leave
 - **Symfony UX / Stimulus**: registers ``controllers.json`` and local controllers, eager or lazy
 - **CDN support**: serve built assets from an absolute ``publicPath``
 - **Subresource Integrity**: SRI hashes in ``entrypoints.json``
+- **Customizable tag attributes**: ``RenderAssetTagEvent`` lets listeners add, change or remove attributes on every rendered tag
 
 It generates the Encore-compatible ``entrypoints.json`` and ``manifest.json`` that ``RepriseBundle`` reads to render
 the ``<script>`` and ``<link>`` tags, wires up the native dev server, and turns your Stimulus controllers into a
@@ -171,6 +172,33 @@ same whether Vite or Rsbuild produced ``entrypoints.json``, and there's nothing
 ``reprise_entry_script_tags`` injects the Vite HMR client automatically, while under Rsbuild the client is compiled
 into the bundle.
 
+Customizing rendered tags
+-------------------------
+
+Before Reprise writes any ``<script>`` or ``<link>`` tag (entry files, CSS, and the dev-server tags it injects itself,
+like the Vite HMR client and the React Fast Refresh preamble), it dispatches a ``RenderAssetTagEvent``.
+A listener can read and mutate ``$event->attributes`` to add, change, or remove attributes on that tag.
+
+As one example, stamping a Content-Security-Policy nonce on every tag::
+
+    namespace App\EventListener;
+
+    use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
+    use Symfony\Reprise\Event\RenderAssetTagEvent;
+
+    #[AsEventListener]
+    final class CspNonceListener
+    {
+        public function __construct(private NonceGenerator $nonceGenerator)
+        {
+        }
+
+        public function __invoke(RenderAssetTagEvent $event): void
+        {
+            $event->attributes['nonce'] = $this->nonceGenerator->getNonce();
+        }
+    }
+
 Features
 --------