Eva SarafianouandCursor c57df45d9c docs: self-host fonts, images, and OpenAPI icons; block build egress (#39092) ...

* docs: self-host fonts, images, and OpenAPI icons; block build egress

Stop hotlinking GitHub/user-images and Google Fonts on the docs site, replace
embedded video iframes with links, and fail CI when a build would fetch
off-origin resources (closed allowlist for the security-updates feed).

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: address CodeRabbit egress review findings

Scan an offline (no-Algolia) rebuild in Docs CI, tighten ATTR/getAttr
boundaries, flag remote template-literal prefixes before ${, and add
alt text for the self-hosted plugin-management image.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: replace egress fixture tree with in-memory unit tests

Keep scanner coverage without committing dozens of tiny HTML/CSS/JS
fixture files. scanSources takes string maps; CLI smoke uses a temp dir.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: keep YouTube/Wistia embeds on hosted site

Restore in-page players for the public docs. Allowlist those hosts in
check-egress; the offline packager strips them for airgap.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: simplify hosted-embed allowlist to base domains

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: tighten hosted-embed allowlist to player kinds and paths

Only iframe/script/img player URLs pass; fetch() and other loads to
YouTube/Wistia hosts still fail egress.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: allow Wistia swatch preload in hosted-embed egress check

The organize-conversations embed emits link[rel=preload] for the
swatch; kind-scoped allowlisting missed it and failed Docs CI.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: use getAttr boundary for script hasSrc check

\b matches inside data-src, so the old hasSrc could skip scanning an
inline script body. Align with ATTR/getAttr and cover the case in tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-13 17:58:54 +03:00

150 KiB

Raw History