erik/erikvancraddock.com
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Adopt safe federated Markdown rendering #29

Merged
erik merged 2 commits from task-21c27f55-federated-markdown into main 2026-10-30 21:10:04 -05:00
Conversation 2 Commits 2 Files changed 7 +479 -45
erik commented 2026-10-30 21:03:45 -05:00
Owner
Copy link

Summary

Adopts the site-owned federated Markdown fix from Slugkit template ZIP 0.12.1, pinned to 9781aff0353e3c4fb91f06fdc9550386a25d1f97.

  • Replace the custom blockquote/plain-text renderer with the release's safe markdown-it renderer in src/federation/content.ts. Preserve blockquotes while adding portable headings, emphasis, lists, code, safe canonical links and linked-image labels; raw HTML stays escaped.
  • Route ActivityPub negotiation for /posts/:slug through the same object builder used by Create, Update and outbox. Preserve primary actor selection, customized canonical-origin/signature handling, browser HTML routes, authentication, setup gate, draft privacy and article permalink-only content.
  • Adapt the released unit/integration regressions and retain the site's blockquote tests. Extend consistency tests to articles, unchanged API source, identity/publication timestamps, authentication, HEAD/ActivityStreams negotiation and the first-run gate. Integration fixtures are synthetic in-memory databases with a capturing queue, and remain local-only.
  • Document adoption and operational boundaries in src/federation/README.md.

Verification

  • npm run typecheck — passed
  • npm run lint — passed
  • npm run build — passed (unrelated generated CSS drift excluded)
  • npm test — 683 passed, 66 files; includes local federation integration tests
  • npm run test:ci — 551 passed, 55 files; excludes integration tests
  • npm run test:browser using PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH pointing to the installed Chromium headless shell — 40 passed. Initial default invocation could not launch because its expected browser revision was not installed.
  • git diff --check — passed
  • README mentions npm run format, but this repository defines no format script; no formatting-tool scope change was made.

Independent read-only review of head e371cc00e09da6330279f1bd1f3128876f13d1e0 found no actionable issues. Its initial P2 warning (flaky timestamp string comparison) was fixed by comparing parsed instants; the reviewer verified the fix and reran 24 targeted tests. Both review reports are posted in PR comments. Full local checks were rerun successfully after the fix.

Remote CI passed at run #108 for reviewed head e371cc00e09da6330279f1bd1f3128876f13d1e0 (CI / build-lint-test (push), successful in 1m29s). Verified through the API because the Forgejo CLI status command cannot parse the server's relative target URL.

Operational boundaries

No dependency/package updates, CLI changes, migrations, deployment, production mutations, or existing-note edits/reposts/backfills. Merging does not authorize publishing a web-release tag or deployment; historical recovery remains deferred. No claim of remote follower adoption is made.

Task: task-21c27f55

## Summary Adopts the site-owned federated Markdown fix from Slugkit template ZIP **0.12.1**, pinned to `9781aff0353e3c4fb91f06fdc9550386a25d1f97`. - Replace the custom blockquote/plain-text renderer with the release's safe `markdown-it` renderer in `src/federation/content.ts`. Preserve blockquotes while adding portable headings, emphasis, lists, code, safe canonical links and linked-image labels; raw HTML stays escaped. - Route ActivityPub negotiation for `/posts/:slug` through the same object builder used by Create, Update and outbox. Preserve primary actor selection, customized canonical-origin/signature handling, browser HTML routes, authentication, setup gate, draft privacy and article permalink-only content. - Adapt the released unit/integration regressions and retain the site's blockquote tests. Extend consistency tests to articles, unchanged API source, identity/publication timestamps, authentication, HEAD/ActivityStreams negotiation and the first-run gate. Integration fixtures are synthetic in-memory databases with a capturing queue, and remain local-only. - Document adoption and operational boundaries in `src/federation/README.md`. ## Verification - `npm run typecheck` — passed - `npm run lint` — passed - `npm run build` — passed (unrelated generated CSS drift excluded) - `npm test` — **683 passed**, 66 files; includes local federation integration tests - `npm run test:ci` — **551 passed**, 55 files; excludes integration tests - `npm run test:browser` using `PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH` pointing to the installed Chromium headless shell — **40 passed**. Initial default invocation could not launch because its expected browser revision was not installed. - `git diff --check` — passed - README mentions `npm run format`, but this repository defines no format script; no formatting-tool scope change was made. Independent read-only review of head `e371cc00e09da6330279f1bd1f3128876f13d1e0` found no actionable issues. Its initial P2 warning (flaky timestamp string comparison) was fixed by comparing parsed instants; the reviewer verified the fix and reran 24 targeted tests. Both review reports are posted in PR comments. Full local checks were rerun successfully after the fix. Remote CI **passed** at [run #108](https://forge.caradoc.com/erik/erikvancraddock.com/actions/runs/108) for reviewed head `e371cc00e09da6330279f1bd1f3128876f13d1e0` (`CI / build-lint-test (push)`, successful in 1m29s). Verified through the API because the Forgejo CLI status command cannot parse the server's relative target URL. ## Operational boundaries No dependency/package updates, CLI changes, migrations, deployment, production mutations, or existing-note edits/reposts/backfills. Merging does **not** authorize publishing a web-release tag or deployment; historical recovery remains deferred. No claim of remote follower adoption is made. Task: `task-21c27f55`
fix: adopt safe federated Markdown rendering
Some checks failed
CI / build-lint-test (push) Has been cancelled
Details
dd631f3d0f 
Adapt Slugkit template 0.12.1 while preserving site federation customizations.\n\nTask: task-21c27f55
erik commented 2026-10-30 21:05:58 -05:00
Author
Owner
Copy link

Reviewed PR #29 at dd631f3d0f803d6a283780baf717ceae04aeb7d5, including all changes and comparison with pinned Slugkit release 9781aff0353e3c4fb91f06fdc9550386a25d1f97.

Non-waived warning

  • P2 — Flaky publication-timestamp assertion: src/federation/__tests__/content.integration.test.ts:93 compares Date.toISOString() against Fedify’s Temporal serialization. Temporal omits trailing fractional zeros, so equivalent timestamps fail comparison: .720Z versus .72Z. My suite run produced 682 passed, 1 failed for this reason; the targeted rerun passed. Fix: compare parsed instants rather than timestamp strings, or normalize both sides consistently. Fix before merge to keep local verification reliable.

Other assessment

No runtime correctness or security blockers found. The renderer matches the pinned release, and the focused routing adaptation preserves the site-specific canonical-origin/signature handling. No optional suggestions.

Verification limits

  • Inspected surrounding publication, routing, privacy, authentication and setup-gate code and tests.
  • Targeted content/outbox rerun: 24 passed.
  • git diff --check passed; working tree unchanged.
  • Browser checks and remote CI were not independently rerun or verified. No external/production requests made.
Reviewed PR #29 at **`dd631f3d0f803d6a283780baf717ceae04aeb7d5`**, including all changes and comparison with pinned Slugkit release `9781aff0353e3c4fb91f06fdc9550386a25d1f97`. ### Non-waived warning - **P2 — Flaky publication-timestamp assertion:** `src/federation/__tests__/content.integration.test.ts:93` compares `Date.toISOString()` against Fedify’s Temporal serialization. Temporal omits trailing fractional zeros, so equivalent timestamps fail comparison: `.720Z` versus `.72Z`. My suite run produced **682 passed, 1 failed** for this reason; the targeted rerun passed. **Fix:** compare parsed instants rather than timestamp strings, or normalize both sides consistently. Fix before merge to keep local verification reliable. ### Other assessment No runtime correctness or security blockers found. The renderer matches the pinned release, and the focused routing adaptation preserves the site-specific canonical-origin/signature handling. No optional suggestions. ### Verification limits - Inspected surrounding publication, routing, privacy, authentication and setup-gate code and tests. - Targeted content/outbox rerun: **24 passed**. - `git diff --check` passed; working tree unchanged. - Browser checks and remote CI were not independently rerun or verified. No external/production requests made.
test: compare federated publication timestamps as instants
All checks were successful
CI / build-lint-test (push) Successful in 1m29s
Details
e371cc00e0 
Address independent review warning about Temporal trimming fractional zeros.
erik commented 2026-10-30 21:08:11 -05:00
Author
Owner
Copy link

Reviewed PR #29 at e371cc00e09da6330279f1bd1f3128876f13d1e0.

No actionable issues found: no blockers, non-waived warnings or optional suggestions. The previous P2 timestamp warning is resolved by comparing parsed instants.

  • Inspected the complete diff, surrounding code and tests; compared against pinned Slugkit release 9781aff0353e3c4fb91f06fdc9550386a25d1f97.
  • Renderer and outbox match the release; routing preserves site-specific identity and canonical-origin handling.
  • Targeted renderer/outbox/content-consistency tests: 24 passed.
  • git diff --check passed; working tree unchanged.

Limits: Full-suite and browser results were not independently rerun. Remote CI remains queued/waiting, not verified passing. No external or production requests made.

Reviewed PR #29 at **`e371cc00e09da6330279f1bd1f3128876f13d1e0`**. **No actionable issues found:** no blockers, non-waived warnings or optional suggestions. The previous P2 timestamp warning is resolved by comparing parsed instants. - Inspected the complete diff, surrounding code and tests; compared against pinned Slugkit release `9781aff0353e3c4fb91f06fdc9550386a25d1f97`. - Renderer and outbox match the release; routing preserves site-specific identity and canonical-origin handling. - Targeted renderer/outbox/content-consistency tests: **24 passed**. - `git diff --check` passed; working tree unchanged. **Limits:** Full-suite and browser results were not independently rerun. Remote CI remains queued/waiting, not verified passing. No external or production requests made.
erik merged commit ff09f2b5f6 into main 2026-10-30 21:10:04 -05:00
erik deleted branch task-21c27f55-federated-markdown 2026-10-30 21:10:05 -05:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug

   
priority:high

   
status:active

   
status:inprogress
No labels
bug
priority:high
status:active
status:inprogress
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
erik/erikvancraddock.com!29
No description provided.