From 9e3b0ffb6fe5ed604785f9e72964f049eec455ce Mon Sep 17 00:00:00 2001
From: Michal Ferber <michal@techguywithabeard.com>
Date: Thu, 3 Sep 2026 17:06:25 -0400
Subject: [PATCH] Run the CSP check that has never run
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tests/csp-check.mjs existed to prove the strict CSP in _headers does not break
the app: script-src carries no 'unsafe-inline', and the print path builds an
iframe srcdoc with an inline <style> that this file exercises. Nothing invoked
it. The only reference to it anywhere in the repo was prose in README.md:107,
so a reader reasonably concluded CSP was covered in CI. It was not.

It also could not have run if something had called it. Line 8 was

  const ROOT = '/home/user/markdownwizard';

an absolute path that exists on no Mac and no GitHub runner. ROOT now derives
from import.meta.url, matching e2e.mjs beside it, which already did this.

Wired into the test job after the e2e suite, where the browser and deps are
already installed by the existing step, so this costs one extra node run and no
new setup.

Verified red before being trusted green, which is the only reason to believe
the green:

  clean repo                          exit 0 — "CSP violations: none"
  inline <script> in index.html       exit 1 — "script-src-elem blocked inline"

The violation message names the directive and offers the sha256 hash, so a
future failure is actionable rather than just red.

Note a real behavioural change: the deploy job declares `needs: test`, so a CSP
violation now blocks deployment rather than merely reporting. That is the point
of the check, but it is a gate that did not exist before this commit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5n34zWrrhGeihpHsCJE3K
---
 .github/workflows/deploy.yml | 10 ++++++++++
 tests/csp-check.mjs          |  8 +++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 43abacb..671048a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -45,6 +45,16 @@ jobs:
         working-directory: tests
         run: node e2e.mjs
 
+      # Serves the repo under the EXACT CSP from _headers and fails on any
+      # securitypolicyviolation. Until 2026-09-03 this file existed and nothing ran
+      # it, so README's claim that CSP is covered was a written argument that had
+      # never been executed. Verified red before being trusted green: an inline
+      # <script> added to index.html produces "script-src-elem blocked inline" and
+      # exit 1.
+      - name: Strict-CSP check (proves _headers does not break the app)
+        working-directory: tests
+        run: node csp-check.mjs
+
   deploy:
     needs: test
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
diff --git a/tests/csp-check.mjs b/tests/csp-check.mjs
index 0e03649..c0c4ee6 100644
--- a/tests/csp-check.mjs
+++ b/tests/csp-check.mjs
@@ -4,8 +4,14 @@ import { chromium } from 'playwright';
 import http from 'node:http';
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-const ROOT = '/home/user/markdownwizard';
+// Derived from this file's own location, never hardcoded: the absolute path this
+// used to carry ('/home/user/markdownwizard') existed only in the sandbox where the
+// file was written, so the check could not have run on a Mac or a CI runner even
+// if something had invoked it. e2e.mjs beside this file already does it this way.
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, '..');
 const CSP = fs.readFileSync(path.join(ROOT, '_headers'), 'utf8')
   .split('\n').find((l) => l.trim().startsWith('Content-Security-Policy:'))
   .split('Content-Security-Policy:')[1].trim();