b6098c28be
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
docs/ARCHITECTURE.md records why internal/web.render replaces the chassis JSON-API policy with a per-response nonce policy, and the failure each of the three decisions prevents: a header-only policy because two policies on one response intersect, a nonce instead of 'unsafe-inline' because the guarantee is that only the reviewed same-document script reaches the fragment key, and a fresh url-alphabet value because a reused nonce is worth 'unsafe-inline' to anyone who waits for the next load and + or / would make enforcement depend on entity decoding. README.md now names the buttons the page actually renders and says outright that there is no lifetime picker — the server's 24h default applies and ttl_seconds is where a caller chooses. base.html drops the opacity transition; nothing animates opacity. .dockerignore is an allowlist, because the build stage COPYs only go.mod, go.sum, vendor/, cmd/ and internal/. A blocklist forgets the file nobody predicted, and for this service that file is a secret. .gitignore grows the same protection for the working tree.
15 lines
458 B
Plaintext
15 lines
458 B
Plaintext
# Allowlist, not a blocklist. The build stage COPYs exactly go.mod, go.sum,
|
|
# vendor/, cmd/ and internal/ — so anything else in the context is bytes Kaniko
|
|
# uploads for nothing, and a `.env` or key dropped in the tree is one a build
|
|
# layer can never capture. A blocklist forgets the file nobody predicted.
|
|
*
|
|
!go.mod
|
|
!go.sum
|
|
!vendor
|
|
!cmd
|
|
!internal
|
|
|
|
# Kaniko reads this before the context is filtered; allowlisted so the two
|
|
# cannot disagree.
|
|
!Dockerfile
|