tiennm99 558d0c75b2 ci: add inline-script guard for built index.html ...

SvelteKit emits one inline bootstrap <script> in build/index.html and
the CSP in static/_headers is relaxed to `script-src 'unsafe-inline'`
to admit it. If a SvelteKit upgrade adds another inline block, the
relaxation no longer matches reality and the new block could ship
unhashed.

`npm run verify:build` reads build/index.html, counts inline scripts
(no `src=`), and fails when count > EXPECTED_INLINE (1). New GH
Actions workflow runs test + build + verify on push/PR to main.

Mutation-tested locally: setting EXPECTED_INLINE=0 fails as expected,
restored to 1 passes.

2026-04-28 10:55:43 +07:00

..

generate-audio.py

chore(audio): generate Vietnamese clips for both voices

2026-04-27 09:11:13 +07:00

verify-build-inline-scripts.mjs

ci: add inline-script guard for built index.html

2026-04-28 10:55:43 +07:00