chore: merge develop → main

[github-actions]

Summary

This automated release PR incorporates CSP hardening and documentation JavaScript refactoring from develop into main.

Changes Included

• CSP Hardening: Removed 'unsafe-inline' from script-src in docs/_includes/head-custom.html.
• Extracted Inline Scripts: Created dedicated external JavaScript file docs/assets/js/main.js.
• Codacy Security & Quality Refactoring:
  • Eliminated string-based innerHTML assignments in favor of safe DOM document.createElementNS / replaceChildren().
  • Added race condition prevention for copy button reset timer (clearTimeout).
  • Added graceful fallback for non-secure contexts (http://) while using navigator.clipboard.writeText in secure contexts.
  • Replaced legacy var declarations with ES6 const/let.
  • Enforced strict mode ('use strict';).

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 27 complexity · 0 duplication

Metric	Results
Complexity	27
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR successfully addresses the security objective of hardening the documentation site by externalizing inline scripts and enforcing a stricter Content Security Policy. The code aligns with the requirement to replace legacy APIs like innerHTML and execCommand.

However, there are a few concerns that should be addressed before finalization:

• Functional Regression: The removal of execCommand (while requested) disables clipboard functionality for users on non-HTTPS connections or older browsers.
• Testing Gap: There are no automated tests included to verify the new clipboard logic or SVG generation.
• UI Polish: A race condition in the copy-button timer may lead to inconsistent visual feedback for users.

While Codacy indicates the project remains up to standards, addressing the duplicated SVG logic and feedback timer would improve overall maintainability and user experience.

About this PR

• The documentation JavaScript refactor lacks automated or browser-based integration tests to verify critical functionality such as the clipboard API and CSP compliance.
• The removal of the execCommand fallback is a functional regression for users on non-HTTPS connections or older browsers where navigator.clipboard is unavailable. Ensure this loss of support is acceptable for the project's browser support targets.
• The PR description is generic and lacks technical context regarding the CSP hardening and JS refactor. While the CHANGELOG provides details, the PR description should be updated to facilitate better tracking in the main branch history.

Test suggestions

• Verify copy-to-clipboard functionality works in modern browsers via navigator.clipboard.
• Verify the Content Security Policy meta tag effectively blocks inline script execution.
• Verify SVG icon elements for 'copy' and 'checked' states are correctly generated and appended to the DOM.
• Verify that copy failures are handled silently as per the refactor requirement.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify copy-to-clipboard functionality works in modern browsers via navigator.clipboard.
2. Verify the Content Security Policy meta tag effectively blocks inline script execution.
3. Verify SVG icon elements for 'copy' and 'checked' states are correctly generated and appended to the DOM.
4. Verify that copy failures are handled silently as per the refactor requirement.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[mendsec]

🟢 PR Review: APPROVED

Pull Request: #85 — chore: merge develop → main
Base Branch: main ⬅️ Head Branch: develop
Review Status: ✅ Approved — Ready to Merge

📝 Summary

PR #85 merges develop into main following the resolution of security and code quality improvements on the GitHub Pages landing page (docs/).

1. CSP Hardening: Removed 'unsafe-inline' from script-src in docs/_includes/head-custom.html.
2. External JS Refactoring: Extracted copy script to docs/assets/js/main.js.
3. Static Analysis & Codacy Fixes: Modernized DOM handling, fallback HTTP clipboard API, timer race condition fix, and Codacy compliance.
4. Changelog: Updated under [Unreleased].

🚦 CI & Status Checks

• Build · test · vet (1.26.x): ✅ PASSED
• govulncheck: ✅ PASSED
• golangci-lint: ✅ PASSED
• Enforce Main Branch Rules: ✅ PASSED
• Codacy Static Code Analysis: ✅ PASSED
• Auto Merge PR (develop → main): ✅ PASSED

🛡️ Compliance Audit

• AGENTS.md Hard Rules (No scanning logic, no CGO, English source, no replace directives)
• Conventional Commits compliant
• Rule 11 Landing Page Review approved

Ready to merge.