diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml
index ff088c8..d21298f 100644
--- a/.woodpecker/ci.yml
+++ b/.woodpecker/ci.yml
@@ -1,4 +1,4 @@
-# CI: runs on every push. Lint, check, test, build (dev), e2e.
+# CI: runs on every push. Install, lint, check, test, build (dev), e2e.
when:
- event: pull_request
- event: push
@@ -7,15 +7,75 @@ when:
- event: manual
steps:
- build:
+ install:
+ image: node:22-bookworm-slim
+ commands:
+ - corepack enable
+ - corepack prepare pnpm@latest --activate
+ - pnpm install --frozen-lockfile
+
+ lint:
image: node:22-bookworm-slim
commands:
- corepack enable
- corepack prepare pnpm@latest --activate
- pnpm install --frozen-lockfile
- pnpm run lint
+ depends_on:
+ - install
+
+ check:
+ image: node:22-bookworm-slim
+ commands:
+ - corepack enable
+ - corepack prepare pnpm@latest --activate
+ - pnpm install --frozen-lockfile
- pnpm run check
+ depends_on:
+ - install
+
+ test:
+ image: node:22-bookworm-slim
+ commands:
+ - corepack enable
+ - corepack prepare pnpm@latest --activate
+ - pnpm install --frozen-lockfile
- pnpm run test:run
+ depends_on:
+ - install
+
+ build:
+ image: node:22-bookworm-slim
+ commands:
+ - corepack enable
+ - corepack prepare pnpm@latest --activate
+ - pnpm install --frozen-lockfile
+ - pnpm run build
+ depends_on:
+ - install
+
+ build-full:
+ image: node:22-bookworm-slim
+ commands:
+ - apt-get update
+ - apt-get install -y --no-install-recommends ca-certificates libasound2 libatk-bridge2.0-0 libatk1.0-0 libcups2 libdrm2 libgbm1 libgtk-3-0 libnss3 libxcomposite1 libxdamage1 libxfixes3 libxkbcommon0 libxrandr2
+ - rm -rf /var/lib/apt/lists/*
+ - corepack enable
+ - corepack prepare pnpm@latest --activate
+ - pnpm install --frozen-lockfile
+ - pnpm run critical-css:install
+ - pnpm run build:full
+ depends_on:
+ - install
+
+ e2e:
+ image: node:22-bookworm-slim
+ commands:
+ - corepack enable
+ - corepack prepare pnpm@latest --activate
+ - pnpm install --frozen-lockfile
- pnpm run build
- pnpm exec playwright install chromium --with-deps
- pnpm run test:e2e
+ depends_on:
+ - build
diff --git a/AGENTS.md b/AGENTS.md
index 32ffa41..23ffa2b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -10,7 +10,8 @@ This repo is a **one-page static** Linktree-style site for mifi.dev. It is **not
- **TypeScript** (always)
- **pnpm** (only); do not use npm or yarn
- **PostCSS** for CSS (nesting + preset-env)
-- **Critical CSS** via post-build script (`scripts/critical-css.mjs`); full build with critical CSS is `pnpm run build:full` (requires Chromium)
+- **Critical CSS** via post-build script (`scripts/critical-css.mjs`); full build with critical CSS is `pnpm run build:full` (run `pnpm run critical-css:install` once to install Chromium)
+- **CSP-safe scripts:** Post-build `scripts/externalize-inline-script.mjs` moves SvelteKit’s inline bootstrap script to `_app/immutable/bootstrap.[hash].js` so CSP can use `script-src 'self'` without `unsafe-inline`
- **Content:** JSON in `src/lib/data/` (e.g. `links.json`), loaded in `+page.server.ts` at build time
- **CSP:** Set by Traefik middleware; do not add CSP in app code
@@ -19,8 +20,8 @@ This repo is a **one-page static** Linktree-style site for mifi.dev. It is **not
- Use **semantic HTML** and **JSON-LD** for SEO; target **WCAG 2.2 AAA** for accessibility.
- **No unsafe-inline** scripts; all JS via `';
+ while (pos < html.length) {
+ if (escape) {
+ escape = false;
+ pos++;
+ continue;
+ }
+ if (inString) {
+ if (html[pos] === '\\') {
+ escape = true;
+ pos++;
+ continue;
+ }
+ if (html[pos] === inString) {
+ inString = null;
+ }
+ pos++;
+ continue;
+ }
+ if (html[pos] === '"' || html[pos] === "'") {
+ inString = html[pos];
+ pos++;
+ continue;
+ }
+ if (html.slice(pos, pos + endTag.length) === endTag) {
+ return {
+ start: scriptStart,
+ end: pos + endTag.length,
+ content: html.slice(contentStart, pos),
+ };
+ }
+ pos++;
+ }
+ return null;
+}
+
+try {
+ let html = readFileSync(htmlPath, 'utf-8');
+ const found = findSvelteKitInlineScript(html);
+ if (!found) {
+ console.log('No SvelteKit inline bootstrap script found in', htmlPath);
+ process.exit(0);
+ }
+ const content = found.content;
+ const hash = createHash('sha256').update(content).digest('hex').slice(0, 8);
+ const filename = `bootstrap.${hash}.js`;
+ const immutableDir = join(buildDir, '_app', 'immutable');
+ mkdirSync(immutableDir, { recursive: true });
+ const scriptPath = join(immutableDir, filename);
+ writeFileSync(scriptPath, content.trimStart(), 'utf-8');
+ const scriptTag = ``;
+ html =
+ html.slice(0, found.start) +
+ scriptTag +
+ html.slice(found.end);
+ writeFileSync(htmlPath, html, 'utf-8');
+ console.log('Externalized SvelteKit bootstrap to', scriptPath);
+} catch (err) {
+ console.error('externalize-inline-script failed:', err instanceof Error ? err.message : String(err));
+ process.exit(1);
+}
diff --git a/src/app.html b/src/app.html
index a29ebdf..7b757ff 100644
--- a/src/app.html
+++ b/src/app.html
@@ -3,12 +3,10 @@
-
- mifi.dev
+
%sveltekit.head%
-
%sveltekit.body%