dc/datacontroller.io
6
1 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: dc/datacontroller.io:59f169e32dfc9d5939046970f1296bac79919cc8
dc/datacontroller.io:main dc/datacontroller.io:feed/two-rule-sets-one-table dc/datacontroller.io:feat/cyber-essentials-badge dc/datacontroller.io:publish-fix dc/datacontroller.io:contact-fix
..
compare: dc/datacontroller.io:bef1b99c78c21b2b5d5075df6031ee86244683a9
dc/datacontroller.io:main dc/datacontroller.io:feed/two-rule-sets-one-table dc/datacontroller.io:feat/cyber-essentials-badge dc/datacontroller.io:publish-fix dc/datacontroller.io:contact-fix
3 Commits
59f169e32d .. bef1b99c78
Author SHA1 Message Date
allan bef1b99c78 Merge pull request 'chore(deploy): drop the stale v6 surfer dependency and the gh-pages workflow' (#31) from chore/prune-stale-deploy-tooling into main
publish / Build-and-publish (push) Successful in 4m7s
Details 
Reviewed-on: #31
 2026-10-28 12:16:33 +00:00
dc 5980e2caba chore(ci): regenerate the lockfile and gate deploys on critical vulns 
Review follow-up.

Lockfile: the previous commit pruned the surfer subtree by hand and left
orphaned nested entries behind (node_modules/cloudron-surfer/node_modules/*,
plus children of removed parents such as @cloudron/pankow's filesize and
express-session's cookie). Regenerated from the unmodified main lockfile with
`npm install --package-lock-only --legacy-peer-deps`, so the lock is npm's own
output rather than an edit. No dangling entries remain.

Publish workflow: added a blocking `npm audit --audit-level=critical` step
between install and build. Critical rather than the suggested default/low: the
tree carries 102 advisories at low/moderate/high that have no non-breaking fix
(mostly the Gatsby 5 build toolchain), so a low gate would fail every deploy
from the first run. The tree is now clear of criticals, having bumped the two
that were live, both within their parents' existing ranges:

- proxy-addr 2.0.7 -> 2.0.8 (GHSA-jqcg-44mw-7w3h, via express ~2.0.7)
- shell-quote 1.8.1 -> 1.12.0 (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv, via
  react-dev-utils ^1.7.3)

.pre-commit-config.yaml: gitleaks hook pinned to v8.30.1 for staged-content
secret scanning. Developer-side only - `pre-commit install` per clone.

Verified: `npm ci --legacy-peer-deps` clean against the regenerated lock,
`npm audit --audit-level=critical` exits 0, build 136 pages, typecheck clean,
lint unchanged at the 8 pre-existing files.
 2026-10-28 12:04:06 +00:00
dc 27a6d98d0c chore(deploy): drop the stale v6 surfer dependency and the gh-pages workflow 
The publish workflow now deploys with `npx --yes @cloudron/surfer@7.2.0`
(pinned) and the v6 `put` command it replaced no longer exists, so
`cloudron-surfer@6` in devDependencies was dead weight in every `npm ci`.

Removing it also drops 35 packages that only existed for its bundled admin
UI (monaco-editor, three, openid-client, ejs, webdav-server, ...). Only those
entries are removed from package-lock.json - no re-resolution, so the diff is
pure deletion.

`.github/workflows/publish.yml` is the pre-Cloudron deploy path: it pushes the
build to a `gh-pages` branch with a third-party action and a `DCSITE` secret.
The site is published by surfer from `.gitea/workflows/publish.yml`, so this
file describes a deploy that cannot run and only misleads a reader looking for
how the site goes live.

Verified locally: `npm ci --legacy-peer-deps` (lock still in sync),
`npm run build` (136 pages), `npm run typecheck` clean, `npm run lint` reports
the same 8 pre-existing files as main and no new ones.
 2026-10-28 11:50:11 +00:00
5 changed files with 36 additions and 1151 deletions
Expand all files Collapse all files

No files matched your search

.gitea/workflows/publish.yml
+9
View File
@@ -26,6 +26,15 @@ jobs:
- name: Install dependencies
run: npm ci --legacy-peer-deps
# Blocking gate, at CRITICAL only. `npm audit` fails on the severity you
# name, so `--audit-level=low` (or the default) would stop every deploy
# today: the Gatsby 5 tree carries ~100 advisories at low/moderate/high
# that have no non-breaking fix, and publishing would simply never run.
# Critical is the line worth stopping a deploy for, and the tree is clear
# of it - keep it that way rather than gating on noise nobody will action.
- name: Audit for critical vulnerabilities
run: npm audit --audit-level=critical
- name: Build
run: npm run build
.github/workflows/publish.yml
-30
View File
@@ -1,30 +0,0 @@
name: Gatsby Publish
on:
push:
branches: main
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Use Node.js from .nvmrc
uses: actions/setup-node@v4
with:
node-version-file: .nvmrc
cache: npm
- name: Install dependencies
run: npm ci --legacy-peer-deps
- name: Check prettier offences
run: npm run lint
- uses: enriikke/gatsby-gh-pages-action@v2
with:
access-token: ${{ secrets.DCSITE }}
deploy-branch: gh-pages
gatsby-args: --prefix-paths
.pre-commit-config.yaml
+12
View File
@@ -0,0 +1,12 @@
# Secret scanning for staged content, so a credential is caught before it is
# committed rather than after it has been pushed and published.
#
# gitleaks is pinned to an exact tag: a floating rev would pull whatever the
# hook's upstream does next into every contributor's commit path.
#
# Install once per clone: `pre-commit install`.
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.30.1
hooks:
- id: gitleaks
package-lock.json
Generated
+15 -1120
View File
File diff suppressed because it is too large. Load diff
package.json
-1
View File
@@ -55,7 +55,6 @@
"@types/react": "^18.3.31",
"@types/react-dom": "^18.3.7",
"bootstrap": "^5.0.0-beta3",
"cloudron-surfer": "^6.4.1",
"jquery": "^3.6.0",
"typescript": "^7.0.2"
},