Merge pull request 'Deploy: clean prod build — strip CGI content' (#112) from stage into main

Merge PR #98 from dev into stage

.gitea/workflows/stage.yaml

@@ -82,12 +82,7 @@ jobs:
           echo "Changed files:"
           echo "$CHANGED"
           NON_ASSET=$(echo "$CHANGED" | grep -v '^src/assets/' | grep -v '^src/shares/' | grep -v '^src/index\.html' | grep -v '^src/about\.html' | grep -v '^src/terms\.html' | grep -v '^src/enterprise-terms\.html' | grep -v '^src/llms\.txt' | grep -v '^migrations/' | grep -v '^scripts/' | grep -v '^tests/' | grep -v '^\.gitea/' | grep -v '^$' || true)
-          if [ -z "$CHANGED" ] || [ "$CHANGED" = "unknown" ]; then
-            # No diff (workflow_dispatch with no new commits, or git error).
-            # Registry may not have a stage-latest base image, so force full build.
-            echo "asset_only=false" >> "$GITHUB_OUTPUT"
-            echo "=> No changed files detected (workflow_dispatch?), forcing full build"
-          elif [ -z "$NON_ASSET" ]; then
+          if [ -z "$NON_ASSET" ] && [ "$CHANGED" != "unknown" ]; then
             echo "asset_only=true" >> "$GITHUB_OUTPUT"
             echo "=> Asset-only change detected, will use fast path"
           else

Dockerfile.stage

@@ -9,7 +9,6 @@
 #
 # CI pre-build steps (in stage.yaml):
 #   - neuron-web: built by `elb build` → dist/neuron-landing
-# Last rebuilt: 2026-05-11
 
 FROM ubuntu:24.04
 

dist/elhtml_impl.c

@@ -1,4 +1,3 @@
-// elhtml_impl.c — El HTML element stubs.
 #include <stdint.h>
 #include <stdlib.h>
 #include "el_runtime.h"
@@ -20,11 +19,11 @@ el_val_t el_li(el_val_t attrs, el_val_t children);
 el_val_t el_p(el_val_t attrs, el_val_t children);
 el_val_t el_span(el_val_t attrs, el_val_t children);
 el_val_t el_form(el_val_t attrs, el_val_t children);
-el_val_t el_h1(el_val_t attrs, el_val_t children);
-el_val_t el_h2(el_val_t attrs, el_val_t children);
-el_val_t el_h3(el_val_t attrs, el_val_t children);
-el_val_t el_h4(el_val_t attrs, el_val_t children);
-el_val_t el_button(el_val_t attrs, el_val_t children);
+el_val_t el_h1(el_val_t attrs, el_val_t text);
+el_val_t el_h2(el_val_t attrs, el_val_t text);
+el_val_t el_h3(el_val_t attrs, el_val_t text);
+el_val_t el_h4(el_val_t attrs, el_val_t text);
+el_val_t el_button(el_val_t attrs, el_val_t label);
 el_val_t el_a(el_val_t href, el_val_t attrs, el_val_t children);
 el_val_t el_input(el_val_t type_attr, el_val_t attrs);
 el_val_t el_textarea(el_val_t attrs, el_val_t value);
@@ -177,43 +176,43 @@ el_val_t el_form(el_val_t attrs, el_val_t children) {
   return 0;
 }
 
-el_val_t el_h1(el_val_t attrs, el_val_t children) {
+el_val_t el_h1(el_val_t attrs, el_val_t text) {
   if (str_eq(attrs, EL_STR(""))) {
-    return el_str_concat(el_str_concat(EL_STR("<h1>"), children), EL_STR("</h1>"));
+    return el_str_concat(el_str_concat(EL_STR("<h1>"), el_escape(text)), EL_STR("</h1>"));
   }
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h1 "), attrs), EL_STR(">")), children), EL_STR("</h1>"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h1 "), attrs), EL_STR(">")), el_escape(text)), EL_STR("</h1>"));
   return 0;
 }
 
-el_val_t el_h2(el_val_t attrs, el_val_t children) {
+el_val_t el_h2(el_val_t attrs, el_val_t text) {
   if (str_eq(attrs, EL_STR(""))) {
-    return el_str_concat(el_str_concat(EL_STR("<h2>"), children), EL_STR("</h2>"));
+    return el_str_concat(el_str_concat(EL_STR("<h2>"), el_escape(text)), EL_STR("</h2>"));
   }
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h2 "), attrs), EL_STR(">")), children), EL_STR("</h2>"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h2 "), attrs), EL_STR(">")), el_escape(text)), EL_STR("</h2>"));
   return 0;
 }
 
-el_val_t el_h3(el_val_t attrs, el_val_t children) {
+el_val_t el_h3(el_val_t attrs, el_val_t text) {
   if (str_eq(attrs, EL_STR(""))) {
-    return el_str_concat(el_str_concat(EL_STR("<h3>"), children), EL_STR("</h3>"));
+    return el_str_concat(el_str_concat(EL_STR("<h3>"), el_escape(text)), EL_STR("</h3>"));
   }
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h3 "), attrs), EL_STR(">")), children), EL_STR("</h3>"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h3 "), attrs), EL_STR(">")), el_escape(text)), EL_STR("</h3>"));
   return 0;
 }
 
-el_val_t el_h4(el_val_t attrs, el_val_t children) {
+el_val_t el_h4(el_val_t attrs, el_val_t text) {
   if (str_eq(attrs, EL_STR(""))) {
-    return el_str_concat(el_str_concat(EL_STR("<h4>"), children), EL_STR("</h4>"));
+    return el_str_concat(el_str_concat(EL_STR("<h4>"), el_escape(text)), EL_STR("</h4>"));
   }
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h4 "), attrs), EL_STR(">")), children), EL_STR("</h4>"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<h4 "), attrs), EL_STR(">")), el_escape(text)), EL_STR("</h4>"));
   return 0;
 }
 
-el_val_t el_button(el_val_t attrs, el_val_t children) {
+el_val_t el_button(el_val_t attrs, el_val_t label) {
   if (str_eq(attrs, EL_STR(""))) {
-    return el_str_concat(el_str_concat(EL_STR("<button type=\"button\">"), children), EL_STR("</button>"));
+    return el_str_concat(el_str_concat(EL_STR("<button type=\"button\">"), el_escape(label)), EL_STR("</button>"));
   }
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<button type=\"button\" "), attrs), EL_STR(">")), children), EL_STR("</button>"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("<button type=\"button\" "), attrs), EL_STR(">")), el_escape(label)), EL_STR("</button>"));
   return 0;
 }