feat(docs): deploy Sphinx site to Cloudflare - #49
Merged
Conversation
Reviewer's GuideDocs workflow now builds Sphinx/Furo docs via npm/uv, publishes the built artifact to Cloudflare Workers on oneroll.hydroroll.team behind a protected production environment, and adds tests and docs to enforce the deployment contract and smoke checks. Sequence diagram for the new docs CI build-and-deploy pipelinesequenceDiagram
actor Developer
participant GitHubActions
participant docs_build_job
participant docs_deploy_job
participant CloudflareWranglerAction
participant CloudflareWorkers
Developer->>GitHubActions: push to main with docs changes
GitHubActions->>docs_build_job: start build job
docs_build_job->>docs_build_job: npm run docs:build
docs_build_job->>docs_build_job: actions/upload-artifact
docs_build_job-->>GitHubActions: build artifact oneroll-docs-${{ github.sha }}
alt [ref is main && event is push]
GitHubActions->>docs_deploy_job: start deploy job
docs_deploy_job->>docs_deploy_job: actions/download-artifact
docs_deploy_job->>CloudflareWranglerAction: cloudflare/wrangler-action deploy
CloudflareWranglerAction->>CloudflareWorkers: deploy --config wrangler.docs.jsonc --strict
docs_deploy_job->>CloudflareWorkers: curl smoke checks on core pages
docs_deploy_job->>CloudflareWorkers: curl 404 check for missing page
else [pull_request or non-main]
GitHubActions-->>Developer: build-only, no deploy
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
HsiangNianian
marked this pull request as ready for review
July 30, 2026 18:25
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 14 security issues, 4 other issues, and left some high level feedback:
Security issues:
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- Apache-2.0 AND LGPL-3.0-or-later AND MIT: Open-source license can require releasing the entire application source (link)
- Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
General comments:
- The deployment smoke test in
docs.ymlhardcodes specific paths and the 404 check inline in the workflow; consider moving these checks into a reusable script so they can be versioned and updated alongside the docs code without editing the workflow YAML. - The
Verify deployment artifactstep indocs.ymlasserts the presence of the stringfuroinindex.html, which couples the pipeline to the current theme; replacing this with a more stable structural check (e.g., a known element or metadata) would make the build verification less brittle if the theme or branding changes.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The deployment smoke test in `docs.yml` hardcodes specific paths and the 404 check inline in the workflow; consider moving these checks into a reusable script so they can be versioned and updated alongside the docs code without editing the workflow YAML.
- The `Verify deployment artifact` step in `docs.yml` asserts the presence of the string `furo` in `index.html`, which couples the pipeline to the current theme; replacing this with a more stable structural check (e.g., a known element or metadata) would make the build verification less brittle if the theme or branding changes.
## Individual Comments
### Comment 1
<location path=".github/workflows/docs.yml" line_range="61-65" />
<code_context>
+ - name: Build Furo documentation
+ run: npm run docs:build
+
+ - name: Verify deployment artifact
+ run: |
+ set -euo pipefail
+ test -s docs/_build/html/index.html
+ grep -Fq "furo" docs/_build/html/index.html
+ test ! -e docs/_build/html/.doctrees
+
</code_context>
<issue_to_address>
**suggestion:** Verification relying on the literal string "furo" in index.html is brittle and tightly coupled to the current theme/content.
This assertion is likely to fail on benign changes (theme rename, HTML restructuring, or content edits). If you want to verify that Furo is used, prefer a more stable signal (e.g., checking for a specific CSS/JS asset or a structural marker in a particular element) rather than a generic text occurrence, so the check reflects the build contract rather than page content.
Suggested implementation:
```
- name: Build Furo documentation
run: npm run docs:build
- name: Verify deployment artifact
run: |
set -euo pipefail
test -s docs/_build/html/index.html
grep -Fq '_static/styles/furo.css' docs/_build/html/index.html
test ! -e docs/_build/html/.doctrees
```
This change assumes that the built Furo docs always include a stylesheet link to `_static/styles/furo.css` in `index.html`, which is the default for the Furo Sphinx theme. If your configuration customizes asset paths or names, adjust the `grep` pattern to match a more stable structural marker (e.g. a theme-specific `<div class="content">` wrapper or a `data-theme="furo"` attribute) that reliably indicates the Furo theme is in use.
</issue_to_address>
### Comment 2
<location path="tests/test_quality_gate.py" line_range="66-75" />
<code_context>
+ def test_docs_changes_build_and_deploy_to_cloudflare(self):
</code_context>
<issue_to_address>
**suggestion (testing):** Add assertions that the deploy job consumes the uploaded artifact, not rebuilding docs independently.
Right now the test only asserts that docs are built and that `deploy` depends on `build`. To ensure the deploy job actually uses the built docs, extend the test to check for a correctly configured `actions/download-artifact` (or equivalent) step in `deploy["steps"]` that matches the upload name. This will validate that deployment uses the verified artifact rather than rebuilding or using a different output.
</issue_to_address>
### Comment 3
<location path="tests/test_docs_deployment_contract.py" line_range="7-13" />
<code_context>
+
+
+ROOT = Path(__file__).parents[1]
+WRANGLER_CONFIG = ROOT / "wrangler.docs.jsonc"
+PACKAGE_JSON = ROOT / "package.json"
+
+
+class DocsDeploymentContractTests(unittest.TestCase):
+ def test_wrangler_serves_sphinx_output_on_the_documentation_domain(self):
+ config = json.loads(WRANGLER_CONFIG.read_text(encoding="utf-8"))
+
+ self.assertEqual(config["name"], "oneroll-docs")
</code_context>
<issue_to_address>
**issue (bug_risk):** Using `json.loads` for a `.jsonc` file is fragile and may break when comments or JSONC features are used.
Because Wrangler accepts comments and other JSONC features, this test may fail on a config that Wrangler itself would load successfully (e.g., comments, trailing commas). That makes the test brittle and out of sync with real behavior. Consider using a JSONC/JSON5-capable parser or stripping comments before `json.loads` so the test validates the same syntax rules Wrangler uses.
</issue_to_address>
### Comment 4
<location path="tests/test_docs_deployment_contract.py" line_range="28-18" />
<code_context>
+ ],
+ )
+
+ def test_local_cli_builds_and_deploys_the_same_documentation_target(self):
+ package = json.loads(PACKAGE_JSON.read_text(encoding="utf-8"))
+
+ self.assertTrue(package["private"])
+ self.assertEqual(package["devDependencies"]["wrangler"], "4.116.0")
+ build = package["scripts"]["docs:build"]
+ self.assertEqual(
+ package["scripts"]["docs:clean"],
+ "uv run --frozen sphinx-build -M clean docs/source docs/_build",
</code_context>
<issue_to_address>
**suggestion (testing):** Extend the contract test to cover the `docs:deploy:dry-run` script mentioned in the PR description.
The test currently covers `docs:build` and `docs:deploy`, but not `npm run docs:deploy:dry-run`, which is also part of the deployment toolchain mentioned in the PR description. Please extend the contract test to assert that `docs:deploy:dry-run` exists and targets the same `wrangler.docs.jsonc` config (e.g., dry-run with `--config wrangler.docs.jsonc`) so local dry runs remain aligned with production deployments.
</issue_to_address>
### Comment 5
<location path="package-lock.json" line_range="648-664" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-darwin-arm64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 6
<location path="package-lock.json" line_range="665-681" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-darwin-x64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 7
<location path="package-lock.json" line_range="682-698" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-arm):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 8
<location path="package-lock.json" line_range="699-715" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-arm64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 9
<location path="package-lock.json" line_range="716-732" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-ppc64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 10
<location path="package-lock.json" line_range="733-749" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-riscv64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 11
<location path="package-lock.json" line_range="750-766" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-s390x):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 12
<location path="package-lock.json" line_range="767-783" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-x64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 13
<location path="package-lock.json" line_range="784-800" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linuxmusl-arm64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 14
<location path="package-lock.json" line_range="801-817" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linuxmusl-x64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 15
<location path="package-lock.json" line_range="1002-1018" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-wasm32):** Apache-2.0 AND LGPL-3.0-or-later AND MIT: Open-source license can require releasing the entire application source
This `Apache-2.0 AND LGPL-3.0-or-later AND MIT` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 16
<location path="package-lock.json" line_range="1039-1058" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-win32-arm64):** Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `Apache-2.0 AND LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 17
<location path="package-lock.json" line_range="1059-1078" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-win32-ia32):** Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `Apache-2.0 AND LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 18
<location path="package-lock.json" line_range="1079-1098" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-win32-x64):** Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `Apache-2.0 AND LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+61
to
+65
| - name: Verify deployment artifact | ||
| run: | | ||
| set -euo pipefail | ||
| test -s docs/_build/html/index.html | ||
| grep -Fq "furo" docs/_build/html/index.html |
There was a problem hiding this comment.
suggestion: Verification relying on the literal string "furo" in index.html is brittle and tightly coupled to the current theme/content.
This assertion is likely to fail on benign changes (theme rename, HTML restructuring, or content edits). If you want to verify that Furo is used, prefer a more stable signal (e.g., checking for a specific CSS/JS asset or a structural marker in a particular element) rather than a generic text occurrence, so the check reflects the build contract rather than page content.
Suggested implementation:
- name: Build Furo documentation
run: npm run docs:build
- name: Verify deployment artifact
run: |
set -euo pipefail
test -s docs/_build/html/index.html
grep -Fq '_static/styles/furo.css' docs/_build/html/index.html
test ! -e docs/_build/html/.doctrees
This change assumes that the built Furo docs always include a stylesheet link to _static/styles/furo.css in index.html, which is the default for the Furo Sphinx theme. If your configuration customizes asset paths or names, adjust the grep pattern to match a more stable structural marker (e.g. a theme-specific <div class="content"> wrapper or a data-theme="furo" attribute) that reliably indicates the Furo theme is in use.
Comment on lines
+66
to
+75
| def test_docs_changes_build_and_deploy_to_cloudflare(self): | ||
| workflow = load_workflow("docs.yml") | ||
| push = workflow["on"]["push"] | ||
| pull_request = workflow["on"]["pull_request"] | ||
|
|
||
| self.assertEqual(push["branches"], ["main"]) | ||
| for changed_paths in (push["paths"], pull_request["paths"]): | ||
| self.assertIn("docs/**", changed_paths) | ||
| self.assertIn("wrangler.docs.jsonc", changed_paths) | ||
|
|
There was a problem hiding this comment.
suggestion (testing): Add assertions that the deploy job consumes the uploaded artifact, not rebuilding docs independently.
Right now the test only asserts that docs are built and that deploy depends on build. To ensure the deploy job actually uses the built docs, extend the test to check for a correctly configured actions/download-artifact (or equivalent) step in deploy["steps"] that matches the upload name. This will validate that deployment uses the verified artifact rather than rebuilding or using a different output.
Comment on lines
+7
to
+13
| WRANGLER_CONFIG = ROOT / "wrangler.docs.jsonc" | ||
| PACKAGE_JSON = ROOT / "package.json" | ||
|
|
||
|
|
||
| class DocsDeploymentContractTests(unittest.TestCase): | ||
| def test_wrangler_serves_sphinx_output_on_the_documentation_domain(self): | ||
| config = json.loads(WRANGLER_CONFIG.read_text(encoding="utf-8")) |
There was a problem hiding this comment.
issue (bug_risk): Using json.loads for a .jsonc file is fragile and may break when comments or JSONC features are used.
Because Wrangler accepts comments and other JSONC features, this test may fail on a config that Wrangler itself would load successfully (e.g., comments, trailing commas). That makes the test brittle and out of sync with real behavior. Consider using a JSONC/JSON5-capable parser or stripping comments before json.loads so the test validates the same syntax rules Wrangler uses.
| self.assertEqual(config["name"], "oneroll-docs") | ||
| self.assertEqual(config["assets"]["directory"], "./docs/_build/html") | ||
| self.assertEqual(config["assets"]["not_found_handling"], "none") | ||
| self.assertEqual( |
There was a problem hiding this comment.
suggestion (testing): Extend the contract test to cover the docs:deploy:dry-run script mentioned in the PR description.
The test currently covers docs:build and docs:deploy, but not npm run docs:deploy:dry-run, which is also part of the deployment toolchain mentioned in the PR description. Please extend the contract test to assert that docs:deploy:dry-run exists and targets the same wrangler.docs.jsonc config (e.g., dry-run with --config wrangler.docs.jsonc) so local dry runs remain aligned with production deployments.
Comment on lines
+648
to
+664
| "node_modules/@img/sharp-libvips-darwin-arm64": { | ||
| "version": "1.3.1", | ||
| "resolved": "https://registry.npmmirror.com/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.1.tgz", | ||
| "integrity": "sha512-4V/M3roRMTYjiwZY9IOVQOE8OyeCxFAkYmyZDrZl51uOKjibm3oeEJ4WAmLxutAfzFbC9jqUiPs2gbnGflH+7g==", | ||
| "cpu": [ | ||
| "arm64" | ||
| ], | ||
| "dev": true, | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "darwin" | ||
| ], | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-darwin-arm64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
+801
to
+817
| "node_modules/@img/sharp-libvips-linuxmusl-x64": { | ||
| "version": "1.3.1", | ||
| "resolved": "https://registry.npmmirror.com/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.1.tgz", | ||
| "integrity": "sha512-yO21HwoUVLN8Qa+/SBjQLMYwBWAVJjeGPNe+hc0OUeMeifEtJqu5a1c4HayE1nNpDih9y3/KkoltfkDodmKAlg==", | ||
| "cpu": [ | ||
| "x64" | ||
| ], | ||
| "dev": true, | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "linux" | ||
| ], | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-linuxmusl-x64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
+1002
to
+1018
| "node_modules/@img/sharp-wasm32": { | ||
| "version": "0.35.2", | ||
| "resolved": "https://registry.npmmirror.com/@img/sharp-wasm32/-/sharp-wasm32-0.35.2.tgz", | ||
| "integrity": "sha512-Mrv4JQNYVQ94xH+jzZ9r+gowleN8mv2FTgKT+PI6bx5C0G8TdNYndu161pg2i7uoBwxy2ImPMHrJOM2LZef7Bw==", | ||
| "dev": true, | ||
| "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT", | ||
| "optional": true, | ||
| "dependencies": { | ||
| "@emnapi/runtime": "^1.11.1" | ||
| }, | ||
| "engines": { | ||
| "node": ">=20.9.0" | ||
| }, | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-wasm32): Apache-2.0 AND LGPL-3.0-or-later AND MIT: Open-source license can require releasing the entire application source
This Apache-2.0 AND LGPL-3.0-or-later AND MIT open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
+1039
to
+1058
| "node_modules/@img/sharp-win32-arm64": { | ||
| "version": "0.35.2", | ||
| "resolved": "https://registry.npmmirror.com/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.2.tgz", | ||
| "integrity": "sha512-BiVRYc/t6/Vl3e1hBx0hugG4oN9Pydf4fgMSpxTQJmwGUg/YoXTWHiFeRymHfCZzifxu4F4rpk/I67D0LQ20wQ==", | ||
| "cpu": [ | ||
| "arm64" | ||
| ], | ||
| "dev": true, | ||
| "license": "Apache-2.0 AND LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "win32" | ||
| ], | ||
| "engines": { | ||
| "node": ">=20.9.0" | ||
| }, | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-win32-arm64): Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This Apache-2.0 AND LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
+1059
to
+1078
| "node_modules/@img/sharp-win32-ia32": { | ||
| "version": "0.35.2", | ||
| "resolved": "https://registry.npmmirror.com/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.2.tgz", | ||
| "integrity": "sha512-YYEhx9PImCC7T0tI8JDMi4DB9LwLCXCU5OWNYEXAxh5Q1ShKkyC6byxzoBJ3gEFDnH2lQckWuDe70G7mB2XJog==", | ||
| "cpu": [ | ||
| "ia32" | ||
| ], | ||
| "dev": true, | ||
| "license": "Apache-2.0 AND LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "win32" | ||
| ], | ||
| "engines": { | ||
| "node": "^20.9.0" | ||
| }, | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-win32-ia32): Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This Apache-2.0 AND LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
+1079
to
+1098
| "node_modules/@img/sharp-win32-x64": { | ||
| "version": "0.35.2", | ||
| "resolved": "https://registry.npmmirror.com/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.2.tgz", | ||
| "integrity": "sha512-imoOyBcoM/iiUr4J6VPpCNjPnjvP/Gks95898yB8YqoGGYmHYbOyCuNv9FMhFgtaiHFGbHW8bxKqRV6VjtXThQ==", | ||
| "cpu": [ | ||
| "x64" | ||
| ], | ||
| "dev": true, | ||
| "license": "Apache-2.0 AND LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "win32" | ||
| ], | ||
| "engines": { | ||
| "node": ">=20.9.0" | ||
| }, | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-win32-x64): Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This Apache-2.0 AND LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
oneroll.hydroroll.teammainthrough the protecteddocs-productionenvironmentWhy
The previous workflow published directly to the legacy
gh-pagesbranch and did not verify the production domain. This gives the documentation a reproducible build, a least-privilege PR path, and a post-deploy production check.Related to #20.
Validation
uv run --frozen python -m unittest discover -s tests -v— 91 passeduv run ruff check .uv run ruff format --check .npm run docs:buildnpm run docs:deploy:dry-runnpm audit --registry=https://registry.npmjs.org— 0 vulnerabilitiesSummary by Sourcery
Deploy the Sphinx/Furo documentation site to Cloudflare Workers using a reproducible artifact built in CI and gated by the existing quality workflow.
New Features:
Enhancements:
Documentation:
Tests: