Staging

[earzalien]

Summary by cubic

Dual branch deployments for production and staging with a hardened SSH deploy flow. Polished CTAs and responsive UI, plus safer date selection in CreateTrip.

• New Features

  • Deploy workflow routes to the correct VPS script based on branch (main → production, staging → staging).

• Refactors

  • CI/CD: ssh-agent, known_hosts setup, removed StrictHostKeyChecking flags; removed Traefik deploy/remove workflows; dropped pre-commit hook.
  • CreateTrip: controlled start date, end date min = start date, end date disabled until start date, invalid ranges auto-reset.
  • Frontend: unified CTA text (“Créer un voyage”), standardized btn-primary/secondary, sticky Navbar with cleaner layout, responsive tweaks across Navbar, Home, CreateTrip, Footer; Home trip count fetch now fails gracefully.

^{Written for commit 17cd16b. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 12 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/deploy.yml">

<violation number="1" location=".github/workflows/deploy.yml:26">
P1: Avoid `StrictHostKeyChecking=no` in deployment SSH commands; it disables host verification and exposes deployments to MITM attacks. Configure known_hosts (e.g., via `ssh-keyscan`) or use `StrictHostKeyChecking=accept-new` with a pinned host key instead.</violation>
</file>

<file name="client/src/pages/styles/Guests.css">

<violation number="1" location="client/src/pages/styles/Guests.css:120">
P2: The selector was renamed to a misspelled `.btn-primairy`, but that class isn’t used anywhere. These styles will never apply unless the markup is updated. If this was meant to style primary buttons, keep `.btn-primary` (and update all occurrences consistently).</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Add one-off context when rerunning by tagging @cubic-dev-ai with guidance or docs links (including llms.txt)
• Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/deploy.yml">

<violation number="1" location=".github/workflows/deploy.yml:25">
P1: Avoid trusting ssh-keyscan output directly; it can be spoofed by a MITM and defeats host key verification. Store the VPS host key (or fingerprint) in a secret and write it to known_hosts instead.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}