tiennm99 3fd02c14a2 ci(csp): replace 'unsafe-inline' with sha256 hash at build time ...

Postbuild script computes SHA-256 of every inline <script> in
build/index.html and rewrites build/_headers — replacing the
script-src 'unsafe-inline' relaxation with the matching hashes. The
hash regenerates per build (SvelteKit bootstrap embeds a per-build
registration call) so the script must run on every build; chain it
into both `npm run build` and `build:gh`.

verify-build extended to assert build/_headers script-src no longer
contains 'unsafe-inline', so the inject step's output is enforced in
CI. style-src 'unsafe-inline' stays — Svelte's `style:` directives
emit inline attributes that hashes can't cover.

2026-04-28 11:09:32 +07:00

android

docs: add post-implementation todo list

2026-04-27 20:21:37 +07:00

web

ci(csp): replace 'unsafe-inline' with sha256 hash at build time

2026-04-28 11:09:32 +07:00

S

Description

Lô Tô (Vietnamese lottery bingo) number board — Next.js web app

bingogamelottonextjstypescriptvietnam

4.1 MiB

0 Stars 1 Watchers 0 Forks

Languages

TypeScript 89.9%

CSS 8%

JavaScript 2.1%