More tweaks to pipeline and some script tweaks

.woodpecker/deploy.yaml

@@ -28,9 +28,9 @@ steps:
           - 'echo "App version: $APP_VERSION"'
           - |
               docker build \
-                --tag "${REGISTRY_REPO}:${CI_COMMIT_SHA}" \
-                --tag "${REGISTRY_REPO}:latest" \
-                --tag "${REGISTRY_REPO}:${APP_VERSION}" \
+                --tag "$REGISTRY_REPO:$CI_COMMIT_SHA" \
+                --tag "$REGISTRY_REPO:latest" \
+                --tag "$REGISTRY_REPO:$APP_VERSION" \
                 --label "git.commit=${CI_COMMIT_SHA}" \
                 --label "git.branch=${CI_COMMIT_BRANCH}" \
                 .
@@ -96,9 +96,9 @@ steps:
               echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_URL" \
                 -u "$REGISTRY_USERNAME" \
                 --password-stdin
-          - 'docker push $REGISTRY_REPO:${CI_COMMIT_SHA}'
+          - 'docker push $REGISTRY_REPO:$CI_COMMIT_SHA'
           - 'docker push $REGISTRY_REPO:latest'
-          - 'docker push $REGISTRY_REPO:${APP_VERSION}'
+          - 'docker push $REGISTRY_REPO:$APP_VERSION'
           - echo "✓ Images pushed successfully"
       depends_on:
           - 'Docker image build'

package.json

@@ -1,6 +1,6 @@
 {
     "name": "mifi-ventures-landing",
-    "version": "4.0.0",
+    "version": "4.0.1",
     "private": true,
     "repository": "https://git.mifi.dev/mifi-ventures/landing.git",
     "packageManager": "pnpm@10.31.0+sha512.e3927388bfaa8078ceb79b748ffc1e8274e84d75163e67bc22e06c0d3aed43dd153151cbf11d7f8301ff4acb98c68bdc5cadf6989532801ffafe3b3e4a63c268",

static/assets/js/cookie-consent.js

@@ -11,6 +11,33 @@
     var BANNER_VISIBLE_CLASS = 'is-visible';
     var hasLoadedThirdParty = false;
 
+    // Trusted Types support (for CSP `require-trusted-types-for 'script'`)
+    var ttPolicy = null;
+    try {
+        if (
+            window.trustedTypes &&
+            typeof window.trustedTypes.createPolicy === 'function'
+        ) {
+            ttPolicy = window.trustedTypes.createPolicy('mifi-ventures-policy', {
+                createScriptURL: function (url) {
+                    return url;
+                },
+            });
+        }
+    } catch (_) {
+        ttPolicy = null;
+    }
+
+    function setScriptSrc(el, url) {
+        if (!el) return;
+        if (ttPolicy) {
+            // When Trusted Types are enforced, wrap URLs via our policy
+            el.src = ttPolicy.createScriptURL(url);
+        } else {
+            el.src = url;
+        }
+    }
+
     function loadThirdPartyAnalytics() {
         if (hasLoadedThirdParty) return;
         hasLoadedThirdParty = true;
@@ -19,14 +46,16 @@
         try {
             var gtagScript = document.createElement('script');
             gtagScript.async = true;
-            gtagScript.src =
-                'https://www.googletagmanager.com/gtag/js?id=G-36F29PDKRT';
+            setScriptSrc(
+                gtagScript,
+                'https://www.googletagmanager.com/gtag/js?id=G-36F29PDKRT',
+            );
 
             gtagScript.onload = function () {
                 // Load the existing ga-init.js helper once gtag is ready
                 var gaInit = document.createElement('script');
                 gaInit.defer = true;
-                gaInit.src = '/assets/js/ga-init.js';
+                setScriptSrc(gaInit, '/assets/js/ga-init.js');
                 document.head.appendChild(gaInit);
             };
 
@@ -40,7 +69,10 @@
         try {
             var clarityScript = document.createElement('script');
             clarityScript.defer = true;
-            clarityScript.src = 'https://www.clarity.ms/tag/vuo5q3yf79?ref=bwt';
+            setScriptSrc(
+                clarityScript,
+                'https://www.clarity.ms/tag/vuo5q3yf79?ref=bwt',
+            );
             document.head.appendChild(clarityScript);
         } catch (e2) {
             console.error('Failed to load Microsoft Clarity', e2);