2 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 5	2f47fa32ee	ci: fix run #1880 — gitleaks false positives, gate docker/renovate on variables, e2e hard ... - gitleaks flagged `STORAGE_KEY = 'cinny_recent_gifs_v1'` (a localStorage key name) as a generic API key. Allowlist namespaced cinny_/lotus- key names on *_KEY assignment lines, and skip dist/, node_modules/ and the vendored Element Call bundle (minified matrix-js-sdk crypto identifiers trip the same rule locally after a build). Verified: 0 findings on this tree with and without dist/ present. - The runner has no `docker` binary and Gitea ignores job-level continue-on-error for the run conclusion, so the docker job painted the run red. It now runs only when the Actions variable CI_HAS_DOCKER is "true"; the weekly renovate job likewise only when RENOVATE_ENABLED is "true" (set alongside the RENOVATE_TOKEN secret). - The Playwright e2e job passed on the runner, so it's a hard gate now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-13 01:43:56 -04:00
jaredandClaude Opus 5	09562061a4	ci: lockfile check, gitleaks, docker smoke job, renovate, shipped nginx security headers ... - "Verify lockfile is in sync" (git diff --exit-code package-lock.json after npm ci) replaces the deleted GitHub lockfile workflow (#99). - gitleaks 8.30.1 binary scan on push + PR with a small allowlist for the public homeserver/registry URLs (#95). - docker job builds the image, runs it and asserts 200 + the security headers; continue-on-error until the runner is confirmed to have a Docker daemon (#93). .dockerignore keeps the context small. - docker-nginx.conf now sends a CSP (frame-src allowlist matching videoEmbed.ts), frame-ancestors 'none', Referrer-Policy and nosniff — shipped config, verify against the live chat.lotusguild.org headers before adopting in prod nginx (#95, #44 shipped-config half). - renovate.json + weekly renovate workflow for cinny and element-call; needs a RENOVATE_TOKEN secret (names starting GITEA_ are reserved) and stays continue-on-error until it exists (#94). - e2e job appended for the Playwright smoke test (#90), continue-on-error until green on the runner. Fixes #93 Fixes #94 Fixes #95 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-13 00:56:23 -04:00