Comparing main...staging · javascriptcm/javascript.cm · GitHub
Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: javascriptcm/javascript.cm
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: javascriptcm/javascript.cm
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: staging
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 10 commits
  • 108 files changed
  • 1 contributor

Commits on Oct 8, 2026

  1. Serve staging on the server IP over HTTPS until DNS is ready 

    Let's Encrypt short-lived IP certificate; both hosts share one site block.
    @BrightkyEfoo
    BrightkyEfoo committed Oct 8, 2026
    Configuration menu
    Copy the full SHA
    14b118b View commit details
    Browse the repository at this point in the history

  2. Readable yellow highlights in dark mode 

    Light text on the yellow marker was unreadable in the dark theme: the
marker becomes a full block with ink text there (like the JS logo),
bounded to the glyphs so tight display line-heights do not bleed over
the line above. Links that turn yellow on hover now switch to ink.
    @BrightkyEfoo
    BrightkyEfoo committed Oct 8, 2026
    Configuration menu
    Copy the full SHA
    1d765ec View commit details
    Browse the repository at this point in the history

  3. Tighten alignments on the home and auth pages 

    - Hero lines share one left edge; stats hairline is full-bleed like the
  other section borders; the featured article byline follows its excerpt
- "Derniers arrivés" gets a real heading aligned with the discussions one
- Open source band: columns aligned at the top, full clone command that
  wraps after slashes, flush on the footer (spacing moved to the layout)
- Auth poster: one inner margin for every block, the yellow block no longer
  covers "code en", pillars stack below 1280px; the toaster sits outside
  the grid (it created an extra row and a paper strip under the panel)
    @BrightkyEfoo
    BrightkyEfoo committed Oct 8, 2026
    Configuration menu
    Copy the full SHA
    93266b9 View commit details
    Browse the repository at this point in the history

  4. Sign in with GitHub, Google and Apple 

    - One social controller and provider modules (no new dependency): state in
  an encrypted cookie, PKCE + nonce for Google, nonce and a fresh ES256
  client-secret JWT for Apple, ID token claims checked (iss, aud, exp, nonce)
- Apple's form_post callback is the only CSRF exception; its state cookie is
  SameSite=None so it survives Apple's cross-site POST
- Accounts link only to verified e-mails, never relink to another provider
  account, banned members are refused; OAuth query strings no longer leak
  into the next redirect
- Buttons follow each brand's rules and appear only for configured
  providers; settings list the linked providers
- isBanned treated freshly created users as banned (bannedAt undefined)
    @BrightkyEfoo
    BrightkyEfoo committed Oct 8, 2026
    Configuration menu
    Copy the full SHA
    45a851c View commit details
    Browse the repository at this point in the history

  5. Professional member profiles with links and CV 

    - Headline, availability (open to work, freelance, hiring), up to 12
  skills, portfolio and up to 4 extra links next to GitHub, LinkedIn, X
- PDF CV (5 MB, magic bytes checked) stored outside public/, with a
  visibility choice (public, members, private); downloads are streamed
  with a sandbox CSP, nosniff, no-store and rate limits. Multipart is
  parsed only inside the CV controller, after auth and CSRF
- Members directory filters by skill, availability and city
- Uploads volume in docker-compose, backed up nightly; Caddy allows
  6 MB on the CV upload only
    @BrightkyEfoo
    BrightkyEfoo committed Oct 8, 2026
    Configuration menu
    Copy the full SHA
    cdfc889 View commit details
    Browse the repository at this point in the history

  6. Keep the ideas not built yet in docs/BRAINSTORMING.md

    @BrightkyEfoo
    BrightkyEfoo committed Oct 8, 2026
    Configuration menu
    Copy the full SHA
    5541409 View commit details
    Browse the repository at this point in the history

  7. Foundation for jobs, events, learning paths, media, e-mails and sponsors 

    - Tables and models: jobs, events + registrations, learning paths / steps /
  progress, media, user tokens (password reset, e-mail verification),
  sponsors, tag pages body, e-mail preferences and locale on users
- Generic notifications with their own sentence and link
- Navigation entries (Emplois, Événements, Apprendre, with a "Plus" menu
  below 1280px) and admin entries; shared captcha key and e-mail status
- Mailer entry point (logs until the mail integration lands)
    @BrightkyEfoo
    BrightkyEfoo committed Oct 8, 2026
    Configuration menu
    Copy the full SHA
    c41aa6c View commit details
    Browse the repository at this point in the history

  8. Add mail, QR code, image processing and OG rendering dependencies

    @BrightkyEfoo
    BrightkyEfoo committed Oct 8, 2026
    Configuration menu
    Copy the full SHA
    4f6172f View commit details
    Browse the repository at this point in the history

  9. Production environment, pull request previews and off-site backups 

    - docker-compose takes its project name and port from .env so staging
  (jscm, 3333), production (jscm-prod, 3334) and previews (jscm-pr-<n>,
  40000+n) live side by side; the deploy health check uses that port
- deploy/dispatch.sh is the only command the CI key may run: deploy
  staging|production, preview up|down; the preview script is always read
  from the staging branch, never from the pull request
- PR previews on pr-<n>.preview.javascript.cm (label "preview", 3 max),
  torn down when the PR closes
- Caddy: production on javascript.cm (www redirects), noindex only on
  non-production hosts, preview sites imported from /etc/caddy/previews
- Backups cover every environment and are pushed off-site, encrypted,
  with restic when /etc/jscm/backup.env is configured
    @BrightkyEfoo
    BrightkyEfoo committed Oct 8, 2026
    Configuration menu
    Copy the full SHA
    f226d54 View commit details
    Browse the repository at this point in the history

  10. Refuse a deploy whose compose project or port is not the environment's 

    Checked after checkout with `docker compose config`: production only
starts once main carries the parametrized docker-compose.yml.
    @BrightkyEfoo
    BrightkyEfoo committed Oct 8, 2026
    Configuration menu
    Copy the full SHA
    19d31cf View commit details
    Browse the repository at this point in the history
Loading