Merge branch 'main' into 4909-text-contrast

Author: n-lark

.github/workflows/test.yml

@@ -10,9 +10,13 @@ jobs:
         id: generate_token
         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
-          app-id: ${{ secrets.GH_BOT_APP_ID }}
-          private-key: ${{ secrets.GH_BOT_APP_KEY }}
+          app-id: ${{ secrets.GH_CI_READONLY_APP_ID }}
+          private-key: ${{ secrets.GH_CI_READONLY_APP_KEY }}
           owner: ${{ github.repository_owner }}
+          repositories: |
+            website
+            flowfuse
+            blueprint-library
       - name: Check out website repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -50,4 +54,3 @@ jobs:
       - uses: untitaker/hyperlink@fb5bb9c5011a3d143a54b4b30aedc30ec5bc0f89 # 0.2.0
         with:
           args: website/_site/ --check-anchors --sources website/src
-

package-lock.json

@@ -68,7 +68,7 @@
         "@11ty/eleventy-fetch": "^4.0.0",
         "@flowfuse/flow-renderer": "^0.5.0",
         "@netlify/blobs": "^10.3.0",
-        "@xmldom/xmldom": "^0.8.12",
+        "@xmldom/xmldom": "^0.8.13",
         "algoliasearch": "^4.25.3",
         "codeowners": "^5.1.1",
         "eleventy-plugin-toc": "^1.1.5",

package.json

@@ -66,6 +66,10 @@ module.exports = async () => {
                 node.categories.push("catalogue");
             }
 
+            const stripRelativeTags = (html) => html
+                .replace(/<link\b[^>]*?\bhref=(?:["']|&quot;)(?!https?:\/\/)[^"'>&]*(?:["']|&quot;)[^>]*\/?>/gi, '')
+                .replace(/<script\b[^>]*?\bsrc=(?:["']|&quot;)(?!https?:\/\/)[^"'>&]*(?:["']|&quot;)[^>]*>(?:[\s\S]*?<\/script>)?/gi, '');
+
             // Fetch full npm node details (readme, etc.)
             try {
                 const nodeDetails = await EleventyFetch(
@@ -133,12 +137,30 @@ module.exports = async () => {
                                                 }
                                             });
 
+                                            let sanitizedFlow = flowContent;
+                                            try {
+                                                const flowJson = JSON.parse(flowContent);
+                                                const sanitizeNode = (n) => {
+                                                    if (n && typeof n === 'object') {
+                                                        if (typeof n.template === 'string') n.template = stripRelativeTags(n.template);
+                                                        if (typeof n.html === 'string') n.html = stripRelativeTags(n.html);
+                                                    }
+                                                    return n;
+                                                };
+                                                if (Array.isArray(flowJson)) {
+                                                    flowJson.forEach(sanitizeNode);
+                                                } else {
+                                                    sanitizeNode(flowJson);
+                                                }
+                                                sanitizedFlow = JSON.stringify(flowJson);
+                                            } catch (_) { /* keep original if not valid JSON */ }
+
                                             return {
                                                 name: file.name.replace('.json', ''), // Remove .json extension for display
                                                 path: file.path,
                                                 url: file.html_url,
                                                 downloadUrl: file.download_url,
-                                                flow: flowContent // Store the actual flow JSON as string
+                                                flow: sanitizedFlow
                                             };
                                         } catch (err) {
                                             console.error(`Failed to fetch flow content for ${file.name}:`, err.message);
@@ -195,6 +217,7 @@ module.exports = async () => {
                                 return match;
                             }
                         );
+                    node.readme = stripRelativeTags(node.readme);
                 } else {
                     node.readme = "";
                 }