.gitea/workflows/publish.yml

@@ -26,6 +26,15 @@ jobs:
       - name: Install dependencies
         run: npm ci --legacy-peer-deps
 
+      # Blocking gate, at CRITICAL only. `npm audit` fails on the severity you
+      # name, so `--audit-level=low` (or the default) would stop every deploy
+      # today: the Gatsby 5 tree carries ~100 advisories at low/moderate/high
+      # that have no non-breaking fix, and publishing would simply never run.
+      # Critical is the line worth stopping a deploy for, and the tree is clear
+      # of it - keep it that way rather than gating on noise nobody will action.
+      - name: Audit for critical vulnerabilities
+        run: npm audit --audit-level=critical
+
       - name: Build
         run: npm run build
 

.github/workflows/publish.yml

@@ -1,30 +0,0 @@
-name: Gatsby Publish
-
-on:
-  push:
-    branches: main
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Use Node.js from .nvmrc
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci --legacy-peer-deps
-
-      - name: Check prettier offences
-        run: npm run lint
-
-      - uses: enriikke/gatsby-gh-pages-action@v2
-        with:
-          access-token: ${{ secrets.DCSITE }}
-          deploy-branch: gh-pages
-          gatsby-args: --prefix-paths

.pre-commit-config.yaml

@@ -0,0 +1,12 @@
+# Secret scanning for staged content, so a credential is caught before it is
+# committed rather than after it has been pushed and published.
+#
+# gitleaks is pinned to an exact tag: a floating rev would pull whatever the
+# hook's upstream does next into every contributor's commit path.
+#
+# Install once per clone: `pre-commit install`.
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks

package.json

@@ -55,7 +55,6 @@
     "@types/react": "^18.3.31",
     "@types/react-dom": "^18.3.7",
     "bootstrap": "^5.0.0-beta3",
-    "cloudron-surfer": "^6.4.1",
     "jquery": "^3.6.0",
     "typescript": "^7.0.2"
   },