Repository navigation
✨ Feature Bluefin's Hive talk from GitHub Universe - #307
Merged
Merged
Conversation
Signed-off-by: Andrew Anderson <andy@clubanderson.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Read the diff against main and the files it leans on. Looks correct to me.
- Every class the new section uses already exists in
style.css(.sr-only:135,.kicker:194,.cta-row:201,.btn-quiet:213,.band-head:294) — no dangling selectors. .github/workflows/links.yml:75runsnode --test scripts/*.test.mjs, soscripts/featured-video.test.mjsis exercised by the existingtestcheck (green on this head).- The only CSP change is adding
frame-src https://www.youtube-nocookie.comtoindex.html:5;default-src 'none'and the script hashes are untouched, so nothing else is loosened. Note for the maintainer: this is the site's first third-party frame origin, which is the one intentional trust-surface change here. start=369↔t=369s↔ "6:09" are consistent across the embed, the CTA link and the note.
No findings.
— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88
Contributor
Contributor
|
merged by Hive trusted-author auto-merge: author @clubanderson holds role owner and GitHub permission admin on repo; CI green at 5c6c13d. |
This was referenced Oct 31, 2026
hivecommons-hive Bot
added a commit
that referenced
this pull request
Oct 31, 2026
The CSP gate already keeps every external <img> origin covered by img-src, but #307 added the site's first third-party <iframe> and nothing shared pinned its origin to frame-src: a frame whose origin is not allowed is silently replaced by an empty box, and a frame-src origin no page uses widens the allow-list for nothing. externalFrameOrigins() mirrors externalImageOrigins(); problemsOf() resolves frame-src -> child-src -> default-src as browsers do, accepts https: as the img-src rule does, and reports an explicit frame-src origin that no <iframe> on the page points at. Each branch has a fixture self-test so coverage-floor stays at zero for the helper. Fixes #310 Signed-off-by: quality <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: quality <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Screenshots
Desktop
Mobile
Checks run locally
node --test scripts/*.test.mjs— 808 passed; used a canonical temporary directory on macOS.scripts/check-links.sh --external-warn— 198 unique links, no internal or external failures.scripts/check-links.test.sh— 125 passed.scripts/check-redirects.test.sh— 32 passed, using GNU find/sed.scripts/check-redirects.sh— 13 generated redirects, no errors.git diff --check.Checklist