tiennm99 7c893aa3b5 ci(csp): replace 'unsafe-inline' with sha256 hash at build time ...

Postbuild script computes SHA-256 of every inline <script> in
build/index.html and rewrites build/_headers — replacing the
script-src 'unsafe-inline' relaxation with the matching hashes. The
hash regenerates per build (SvelteKit bootstrap embeds a per-build
registration call) so the script must run on every build; chain it
into both `npm run build` and `build:gh`.

verify-build extended to assert build/_headers script-src no longer
contains 'unsafe-inline', so the inject step's output is enforced in
CI. style-src 'unsafe-inline' stays — Svelte's `style:` directives
emit inline attributes that hashes can't cover.

2026-04-28 11:09:32 +07:00

..

generate-audio.py

chore(audio): generate Vietnamese clips for both voices

2026-04-27 09:11:13 +07:00

inject-csp-hashes.mjs

ci(csp): replace 'unsafe-inline' with sha256 hash at build time

2026-04-28 11:09:32 +07:00

verify-build-inline-scripts.mjs

ci(csp): replace 'unsafe-inline' with sha256 hash at build time

2026-04-28 11:09:32 +07:00