From 39203acabab924ba4942df911038ce36547d591d Mon Sep 17 00:00:00 2001 From: iuhoay Date: Sat, 1 Aug 2026 23:24:45 +0800 Subject: [PATCH 1/3] chore: bump rails main to dd1c884 (2026-08-01) - Includes GHSA-xr9x-r78c-5hrm fix: Active Storage disables libvips unfuzzed loaders (Vips.block_untrusted(true)) - solid_queue 1.5.0 -> 1.6.0 (fiber execution mode, additive) - annotaterb 4.23.0 -> 4.24.0 - 303 tests green, no deprecation warnings --- Gemfile.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 4240aa9..c5b038e 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,6 +1,6 @@ GIT remote: https://github.com/rails/rails.git - revision: cd269b7a6287c6fdce464c7d148202c5c4f7d179 + revision: dd1c8848dcde00991f8d198775e08a0b44a95fac branch: main specs: actioncable (8.2.0.alpha) @@ -119,7 +119,7 @@ GEM railties addressable (2.9.0) public_suffix (>= 2.0.2, < 8.0) - annotaterb (4.23.0) + annotaterb (4.24.0) activerecord (>= 6.0.0) activesupport (>= 6.0.0) ast (2.4.3) @@ -458,7 +458,7 @@ GEM activejob (>= 7.2) activerecord (>= 7.2) railties (>= 7.2) - solid_queue (1.5.0) + solid_queue (1.6.0) activejob (>= 7.1) activerecord (>= 7.1) concurrent-ruby (>= 1.3.1) @@ -583,7 +583,7 @@ CHECKSUMS activestorage (8.2.0.alpha) activesupport (8.2.0.alpha) addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af - annotaterb (4.23.0) sha256=0fc59b1d40e07bec75d9d9b0cd479493631ce8901e4b59fefc561689f22b4600 + annotaterb (4.24.0) sha256=3953d3a3fb86ef06639a8d5ea29001e4af1e51cabd147973b1b23524b8fbced6 ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383 async (2.42.0) sha256=536078293b8c95d5b5679fa01bf7d2458bcc65cd46dec2c4cb3580feaeb965c6 auth-sanitizer (0.2.1) sha256=917dcf01f7589b06c26726afe90568cf2fb29d37a1f94facfc664f11967cc577 @@ -728,7 +728,7 @@ CHECKSUMS snaky_hash (2.0.6) sha256=3663cae48cdef582b517025cf8a39d8789996eaf0b4ed89e2f0624836505654a solid_cable (4.0.2) solid_cache (1.0.10) sha256=bc05a2fb3ac78a6f43cbb5946679cf9db67dd30d22939ededc385cb93e120d41 - solid_queue (1.5.0) sha256=329f29caab9cc68eefe489013eb5a38ea4a66708ed2bee301384dbed91890f7f + solid_queue (1.6.0) sha256=b5fc3bb34162e09d8f960df6400d0f9304dc80fe66c2cfface31c32b228de6a1 sshkit (1.25.0) sha256=c8c6543cdb60f91f1d277306d585dd11b6a064cb44eab0972827e4311ff96744 stimulus-rails (1.3.4) sha256=765676ffa1f33af64ce026d26b48e8ffb2e0b94e0f50e9119e11d6107d67cb06 stringio (3.2.0) sha256=c37cb2e58b4ffbd33fe5cd948c05934af997b36e0b6ca6fdf43afa234cf222e1 From 470e97e62f271b6ca642a92d59eed848f8e65dcd Mon Sep 17 00:00:00 2001 From: iuhoay Date: Sat, 1 Aug 2026 23:24:45 +0800 Subject: [PATCH 2/3] fix: pin PWA manifest/service-worker route formats rails main lost the PwaController formats fix, so /manifest 500s with MissingTemplate for clients that send no Accept header. Pin the format (defaults: { format: }) on both routes. --- config/routes.rb | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/config/routes.rb b/config/routes.rb index cb6a1c9..8f69a3d 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -30,9 +30,12 @@ get "up" => "rails/health#show", as: :rails_health_check - # Render dynamic PWA files from app/views/pwa/* - get "manifest" => "rails/pwa#manifest", as: :pwa_manifest - get "service-worker" => "rails/pwa#service_worker", as: :pwa_service_worker + # Render dynamic PWA files from app/views/pwa/*. Each exists in a single + # format (manifest.json.erb, service-worker.js), so pin it — clients that + # don't Accept it (crawlers send no Accept header) would otherwise 500 with + # a MissingTemplate looking for an HTML variant. + get "manifest" => "rails/pwa#manifest", as: :pwa_manifest, defaults: { format: "json" } + get "service-worker" => "rails/pwa#service_worker", as: :pwa_service_worker, defaults: { format: "js" } get "offline" => "pwa#offline", as: :pwa_offline # Self-hosted performance monitoring dashboard (admin-only; see config/initializers/rails_pulse.rb) From e6c0c1558c659f5326f4ec7b0a8bf81897bc1696 Mon Sep 17 00:00:00 2001 From: iuhoay Date: Sat, 1 Aug 2026 23:26:42 +0800 Subject: [PATCH 3/3] docs: mandate bin/ci before every commit --- CLAUDE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 6177d54..76c6d24 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -18,7 +18,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co - `bin/setup` — bootstrap dev (idempotent); requires Postgres reachable and `.env` configured - `bin/rails test` — Minitest. Rails 8.2's `creds` only merges `.env` in dev, so test sees nil from `creds.option(...)`; `config/database.yml` carries `root` / `password` defaults on each call as the local-dev fallback. Real `ENV` overrides if your Postgres differs. See atom `invariant_dotenv_test_env`. - `bin/rubocop` — omakase style (Ruby files only) -- `bin/ci` — full local gate before a PR (config in `config/ci.rb`): setup + RuboCop + bundler-audit + importmap audit + Brakeman + tests. GitHub Actions runs the same plus Capybara system tests. +- `bin/ci` — mandatory before ANY commit (user-mandated 2026-08-01): setup + RuboCop + bundler-audit + importmap audit + Brakeman + tests. Config in `config/ci.rb`. GitHub Actions runs the same plus Capybara system tests. - `bin/rails search:reindex` — rebuild every `Entry` and `SavedItem` search vector after a tokenization change; in production run it through the `bin/kamal reindex` alias after deploying the new tokenizer. - Recurring (`config/recurring.yml`): `RefreshDueFeedsJob` every 10 min (all envs); production also renews WebSub leases (6 h), clears finished Solid Queue jobs (hourly), and runs Rails Pulse summarize/cleanup. - Config is read via `Rails.app.creds.option(...)` (merges `.env` in dev, encrypted credentials in prod) — not stock `Rails.application.credentials` or bare `ENV`.