ci: run check workflow

Author: bhdicaire

.github/workflows/check.yml

@@ -0,0 +1,22 @@
+name: check
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run check

custom/.gitkeep

@@ -372,7 +372,7 @@ function renderSecurityTxt(siteConfig) {
     ""
   ].join("\n");
 
-  for (const filePath of securityTxtPaths()) {
+  for (const filePath of securityTxtWritePaths()) {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     fs.writeFileSync(filePath, content);
   }
@@ -406,15 +406,17 @@ function removeDeferredLegalPages(siteConfig) {
   });
 }
 
-function securityTxtPaths() {
+function securityTxtWritePaths() {
   return [
-    path.join(BUILD_DIR, "security.txt"),
     path.join(BUILD_DIR, ".well-known", "security.txt")
   ];
 }
 
 function removeSecurityTxt() {
-  for (const filePath of securityTxtPaths()) {
+  for (const filePath of [
+    ...securityTxtWritePaths(),
+    path.join(BUILD_DIR, "security.txt")
+  ]) {
     fs.rmSync(filePath, { force: true });
   }
 }

custom/_stats/.gitkeep

@@ -2,6 +2,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
+import { execFileSync } from "node:child_process";
 
 const ROOT = process.cwd();
 const CHECK_EXTENSIONS = new Set([".js", ".mjs", ".json", ".md", ".toml", ".txt"]);
@@ -44,6 +45,22 @@ function lintFile(filePath) {
       failures.push(`${relative}: invalid JSON (${error.message})`);
     }
   }
+
+  if ([".js", ".mjs"].includes(path.extname(filePath))) {
+    try {
+      execFileSync(process.execPath, ["--check", filePath], {
+        cwd: ROOT,
+        stdio: "pipe"
+      });
+    } catch (error) {
+      const output = [error.stdout, error.stderr]
+        .filter(Boolean)
+        .map((buffer) => buffer.toString().trim())
+        .filter(Boolean)
+        .join("\n");
+      failures.push(`${relative}: JavaScript syntax check failed${output ? `\n${output}` : ""}`);
+    }
+  }
 }
 
 function lintWrangler() {

custom/public/.gitkeep

@@ -68,6 +68,10 @@ async function handleRequest(context) {
     return handleExpandAnalytics(request, env, ctx, correlationId);
   }
 
+  if (slug === "security.txt") {
+    return Response.redirect(new URL("/.well-known/security.txt", request.url).toString(), 308);
+  }
+
   if (isProtectedPath(slug)) {
     const accessResponse = await requireCloudflareAccess(request, env);
     if (accessResponse) return accessResponse;

defaults/public/security.txt

@@ -81,6 +81,9 @@ const assets = {
   "/fr/maintenance.html": html("<main>maintenance fr</main>"),
   "/fr/404.html": html("<main>fr {{SLUG_MESSAGE}}{{REFERENCE_LINE}}</main>"),
   "/_tests/index.html": html("<main>tests</main>"),
+  "/.well-known/security.txt": new Response("Contact: mailto:security@example.com\n", {
+    headers: { "content-type": "text/plain; charset=utf-8" }
+  }),
   "/style.css": new Response("body{}", {
     headers: { "content-type": "text/css" }
   }),
@@ -403,6 +406,13 @@ await run("blocks raw site config asset", async () => {
   assert(response.headers.get("x-robots-tag") === "noindex, nofollow", "robots header");
 });
 
+await run("redirects legacy security.txt to well-known security.txt", async () => {
+  const ctx = mockCtx();
+  const response = await worker.fetch(request("/security.txt"), env(), ctx);
+  assert(response.status === 308, "status");
+  assert(response.headers.get("location") === "https://dicai.re/.well-known/security.txt", "location");
+});
+
 await run("requires Cloudflare Access config for protected paths", async () => {
   const ctx = mockCtx();
   const response = await worker.fetch(request("/_tests"), env(), ctx);