Merge branch 'main' into fix-cassandra

Author: Dampolo03

.djlint_rules.yaml

@@ -0,0 +1,4 @@
+- rule:
+    name: C001
+    message: Script tags with src= must include a nonce= attribute
+    python_module: djlint_custom_rules

.github/workflows/pr.yaml

@@ -86,7 +86,7 @@ jobs:
       - name: Install python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          sudo pip3 install djlint
+          sudo pip3 install "$(grep -m1 -E '^djlint==' requirements.txt)"
 
       - name: Get changed HTML files in the templates folder
         id: changed-files
@@ -99,7 +99,7 @@ jobs:
         if: env.CHANGED_FILES != ''
         run: |
           echo "The following files have changed: $CHANGED_FILES"
-          djlint $CHANGED_FILES --lint --profile="jinja"
+          PYTHONPATH=. djlint $CHANGED_FILES --lint --profile="jinja"
 
   test-python:
     runs-on: ubuntu-22.04

AGENTS.md

@@ -88,7 +88,7 @@ yarn lint-scss        # stylelint
 yarn format-python    # black --line-length 79
 yarn format-prettier  # prettier
 
-djlint templates/path/to/file.html --lint --profile=jinja   # djlint for html/jinja - uses `.djlintrc`
+PYTHONPATH=. djlint templates/path/to/file.html --lint --profile=jinja   # djlint for html/jinja - uses `.djlintrc` + custom rules in `.djlint_rules.yaml`
 ```
 
 ## External Service Dependencies

build.js

@@ -20,6 +20,7 @@ let entries = {
   "watch-consent-changes": "./static/js/watch-consent-changes.js",
   "events": "./static/js/events.js",
   "in-page-navigation": "./static/js/in-page-navigation.js",
+  "prism": "./static/js/prism.js",
 };
 
 const isDev = process && process.env && process.env.NODE_ENV === "development";

djlint_custom_rules.py

@@ -0,0 +1,37 @@
+"""Custom djlint linter rules for canonical.com.
+
+Loaded by djlint via ``.djlint_rules.yaml`` (``python_module`` rules). Unlike
+djlint pattern rules, ``python_module`` rules receive the full HTML and are not
+filtered by djlint's ignored-block logic, so they can inspect ``<script>`` tags
+(which djlint otherwise treats as ignored blocks).
+"""
+
+from __future__ import annotations
+
+import re
+
+from djlint.lint import get_line
+
+# Match a single <script ...> opening tag.
+SCRIPT_OPEN_TAG = re.compile(r"<script\b[^>]*>", re.IGNORECASE)
+HAS_SRC = re.compile(r"\bsrc=", re.IGNORECASE)
+HAS_NONCE = re.compile(r"\bnonce\b", re.IGNORECASE)
+
+
+def run(rule, config, html, filepath, line_ends, *args, **kwargs):
+    """C001: <script src=...> tags must include a nonce= attribute."""
+    errors = []
+    for match in SCRIPT_OPEN_TAG.finditer(html):
+        tag = match.group()
+        if not HAS_SRC.search(tag):
+            continue
+        if HAS_NONCE.search(tag):
+            continue
+        snippet = re.sub(r"\s+", " ", tag)[:30]
+        errors.append({
+            "code": rule["name"],
+            "line": get_line(match.start(), line_ends),
+            "match": snippet,
+            "message": rule["message"],
+        })
+    return errors

package.json

@@ -11,9 +11,10 @@
     "format-prettier": "prettier -w 'static/js/*.{js,jsx,ts,tsx}' 'static/sass/*.scss'",
     "lint-python": "flake8 --extend-ignore=E203 webapp tests && black --check --line-length 79 webapp tests",
     "lint-scss": "stylelint static/**/*.scss",
+    "lint-html": "PYTHONPATH=. djlint templates/ --lint",
     "serve": "./entrypoint 0.0.0.0:${PORT}",
     "start": "yarn run build && concurrently --raw 'yarn run watch' 'yarn run serve'",
-    "test": "yarn run lint-scss && yarn run lint-python && yarn run test-python",
+    "test": "yarn run lint-scss && yarn run lint-python && yarn run lint-html && yarn run test-python",
     "test-python": "python3 -m unittest discover tests",
     "test-js": "jest --env=jsdom",
     "test-marketo": "python3 -m unittest tests.test_marketo",
@@ -44,6 +45,7 @@
     "lottie-web": "^5.13.0",
     "postcss": "8.5.10",
     "postcss-cli": "10.1.0",
+    "prismjs": "1.30.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
     "react-router-dom": "^6.24.1",

scripts/build-modules.sh

@@ -31,3 +31,5 @@ cp node_modules/venobox/dist/venobox.min.js static/js/modules/venobox/venobox.mi
 mkdir -p static/js/modules/vanilla-framework/js
 cp -r node_modules/vanilla-framework/templates/_macros/ static/js/modules/vanilla-framework
 cp -r node_modules/vanilla-framework/templates/static/js/tabs.js static/js/modules/vanilla-framework/js/.
+
+mkdir -p static/js/dist/prism-components && cp -r node_modules/prismjs/components/*.min.js static/js/dist/prism-components/

static/js/prism.js

@@ -0,0 +1,8 @@
+import Prism from "prismjs";
+import "prismjs/themes/prism.css";
+import "prismjs/plugins/autoloader/prism-autoloader";
+import "prismjs/plugins/keep-markup/prism-keep-markup";
+
+Prism.plugins.autoloader.languages_path = "/static/js/dist/prism-components/";
+
+export default Prism;

templates/base_index.html

@@ -70,7 +70,7 @@
             Must run before the deferred lite-youtube module upgrades the
             element.
           -->
-          <script nonce="{{ csp_nonce }}">window.liteYouTubeNonce = "{{ csp_nonce }}";</script>
+          <script>window.liteYouTubeNonce = "{{ csp_nonce }}";</script>
 
           {% block extra_metatags %}{% endblock %}
 

templates/blog/article.html

@@ -47,6 +47,7 @@
     }
 </script>
   {# djlint: on #}
+  <script src="{{ versioned_static('js/dist/prism.js') }}" nonce="{{ csp_nonce }}" defer></script>
 {% endblock %}
 
 {% block content %}
@@ -62,13 +63,11 @@
             {% if article.author and article.author.id == 217 %}
               <img src="https://assets.ubuntu.com/v1/f16c40d0-Favicon+-+CoF.svg"
                    class="p-media-object__image u-align-self-center"
-                   alt=""
-                   />
+                   alt="" />
             {% else %}
               <img src="{{ article.author.avatar_urls['96'] }}"
                    class="p-media-object__image is-round u-align-self-center"
-                   alt=""
-                   />
+                   alt="" />
             {% endif %}
           {% endif %}