web: vendor htmx 1.9.12 locally instead of unpkg.com (closes #23) #24

Merged

linus merged 1 commit from ash/vendor-htmx-23 into develop

2026-10-23 13:21:55 +00:00

ash commented

2026-10-23 13:18:03 +00:00

Collaborator

Closes #23

Vendors htmx 1.9.12 (same version as before) into the embedded assets and serves it from the manager at /assets/htmx.min.js. No external script/style hosts remain (grepped templates and static for unpkg/jsdelivr/cdnjs/googleapis and any http(s):// or // src/href: base.html had the only one).

Note: the manager CSP is already script-src 'self', so the unpkg script was blocked by CSP-respecting browsers, not just Brave.

web/static/htmx.min.js: htmx 1.9.12, sha256 449317ade7881e949510db614991e195c3a099c4c791c24dacec55f9f4a2a452
web/templates/base.html: one-line src change, no other UI changes
internal/manager/renderer_assets_test.go: renders all 5 pages through base and asserts no external https:// script/style/link source and the local htmx tag present; scans template+static sources for CDN hosts; asserts /assets/htmx.min.js returns 200, JavaScript content type, version 1.9.12. Verified the test fails (7 errors) when the unpkg tag is restored.

Proof: go build ./... ok; go test ./internal/manager/ ./web/ ok. Toolchain preflight untouched. Revert = plain git revert.

Closes #23 Vendors htmx **1.9.12** (same version as before) into the embedded assets and serves it from the manager at `/assets/htmx.min.js`. No external script/style hosts remain (grepped templates and static for unpkg/jsdelivr/cdnjs/googleapis and any http(s):// or // src/href: base.html had the only one). Note: the manager CSP is already `script-src 'self'`, so the unpkg script was blocked by CSP-respecting browsers, not just Brave. - `web/static/htmx.min.js`: htmx 1.9.12, sha256 `449317ade7881e949510db614991e195c3a099c4c791c24dacec55f9f4a2a452` - `web/templates/base.html`: one-line src change, no other UI changes - `internal/manager/renderer_assets_test.go`: renders all 5 pages through base and asserts no external https:// script/style/link source and the local htmx tag present; scans template+static sources for CDN hosts; asserts `/assets/htmx.min.js` returns 200, JavaScript content type, version 1.9.12. Verified the test fails (7 errors) when the unpkg tag is restored. Proof: `go build ./...` ok; `go test ./internal/manager/ ./web/` ok. Toolchain preflight untouched. Revert = plain git revert.

ash added 1 commit

2026-10-23 13:18:03 +00:00

web: vendor htmx 1.9.12 and serve it from /assets (closes #23 )

CI / check-and-test (pull_request) Successful in 1m0s

Details

ee4e1d8e71

The base template loaded htmx from unpkg.com. The manager CSP is
script-src 'self', and Brave/uBlock/offline boxes block third-party
scripts, so htmx never loaded and the Jobs page hung on Loading jobs.

- web/static/htmx.min.js: htmx 1.9.12 (sha256 449317ad...a452), embedded
- base.html points at /assets/htmx.min.js
- tests: rendered pages and template/static sources carry no external
  script/style/link sources; /assets/htmx.min.js serves 200 JS v1.9.12

ash requested reviews from eva, blake

2026-10-23 13:18:03 +00:00

eva approved these changes

2026-10-23 13:18:58 +00:00

eva left a comment

GO from me on ee4e1d8.

I checked the vendored file against upstream: web/static/htmx.min.js hashes to 449317ad...2a452, the same as unpkg's htmx.org@1.9.12/dist/htmx.min.js, so it's a byte-for-byte copy and nothing was altered. base.html is a one-line src change, and the existing CSP (script-src 'self') now actually allows it. The new tests cover all five pages plus the template/static sources and the served asset, which is what #23 asked for. Scope stays tight, and revert is a plain git revert.

Waiting on CI (run 44) and Blake's look since it's a vendored third-party script. Once both are clear, Linus can land it, and then the 0.0.11 cut follows.

GO from me on ee4e1d8. I checked the vendored file against upstream: `web/static/htmx.min.js` hashes to 449317ad...2a452, the same as unpkg's htmx.org@1.9.12/dist/htmx.min.js, so it's a byte-for-byte copy and nothing was altered. base.html is a one-line src change, and the existing CSP (`script-src 'self'`) now actually allows it. The new tests cover all five pages plus the template/static sources and the served asset, which is what #23 asked for. Scope stays tight, and revert is a plain git revert. Waiting on CI (run 44) and Blake's look since it's a vendored third-party script. Once both are clear, Linus can land it, and then the 0.0.11 cut follows.

blake approved these changes

2026-10-23 13:21:08 +00:00

blake left a comment

GO from me on ee4e1d8e71.

What I checked by hand:

web/static/htmx.min.js (48101 bytes) has sha256 449317ade7881e949510db614991e195c3a099c4c791c24dacec55f9f4a2a452. That matches both unpkg's htmx.org@1.9.12/dist/htmx.min.js and the npm tarball htmx.org-1.9.12.tgz, which I fetched myself from the jumpbox.
There are no CDN or off-host script, link, or style references left anywhere in the tree. The only external host is the server-side Google OAuth userinfo call in internal/auth/auth.go, and that's fine.
The embed path is right. web/embed.go already embeds static, and /assets/* goes to StaticHandler, so the new file is served at /assets/htmx.min.js. The new tests check the script tag, the 1.9.12 version string and the JS content type.
The diff is one commit touching three files: the vendored file, a one-line change in base.html, and a new test. It's based on the develop tip fa697420e2. CI run 44 is green.

Non-blocking: the CSP in manager.go:414 is script-src 'self' 'unsafe-inline', not plain 'self'. That predates this PR, which doesn't make it worse. In fact the old unpkg tag would have been blocked by this CSP. Dropping 'unsafe-inline' later would be worth doing as a follow-up if the page scripts allow it.

GO from me on ee4e1d8e71. What I checked by hand: - `web/static/htmx.min.js` (48101 bytes) has sha256 449317ade7881e949510db614991e195c3a099c4c791c24dacec55f9f4a2a452. That matches both unpkg's htmx.org@1.9.12/dist/htmx.min.js and the npm tarball htmx.org-1.9.12.tgz, which I fetched myself from the jumpbox. - There are no CDN or off-host script, link, or style references left anywhere in the tree. The only external host is the server-side Google OAuth userinfo call in internal/auth/auth.go, and that's fine. - The embed path is right. web/embed.go already embeds `static`, and `/assets/*` goes to StaticHandler, so the new file is served at /assets/htmx.min.js. The new tests check the script tag, the 1.9.12 version string and the JS content type. - The diff is one commit touching three files: the vendored file, a one-line change in base.html, and a new test. It's based on the develop tip fa697420e2. CI run 44 is green. Non-blocking: the CSP in manager.go:414 is `script-src 'self' 'unsafe-inline'`, not plain `'self'`. That predates this PR, which doesn't make it worse. In fact the old unpkg tag would have been blocked by this CSP. Dropping 'unsafe-inline' later would be worth doing as a follow-up if the page scripts allow it.