- "Verify lockfile is in sync" (git diff --exit-code package-lock.json
after npm ci) replaces the deleted GitHub lockfile workflow (#99).
- gitleaks 8.30.1 binary scan on push + PR with a small allowlist for
the public homeserver/registry URLs (#95).
- docker job builds the image, runs it and asserts 200 + the security
headers; continue-on-error until the runner is confirmed to have a
Docker daemon (#93). .dockerignore keeps the context small.
- docker-nginx.conf now sends a CSP (frame-src allowlist matching
videoEmbed.ts), frame-ancestors 'none', Referrer-Policy and nosniff —
shipped config, verify against the live chat.lotusguild.org headers
before adopting in prod nginx (#95, #44 shipped-config half).
- renovate.json + weekly renovate workflow for cinny and element-call;
needs a RENOVATE_TOKEN secret (names starting GITEA_ are reserved) and
stays continue-on-error until it exists (#94).
- e2e job appended for the Playwright smoke test (#90), continue-on-error
until green on the runner.
Fixes#93Fixes#94Fixes#95
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
