feat: meeting-aware suggestions; perf budgets; electron scaffold; csp; ci workflow

Author: Jathow

.github/workflows/ci.yml

@@ -1,5 +1,41 @@
 name: CI
 
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 'lts/*'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npm run type-check
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Unit tests
+        run: npm run test
+
+      - name: Build
+        run: npm run build
+
+name: CI
+
 on:
   push:
     branches: [ main, master ]

.github/workflows/security.yml

@@ -0,0 +1,21 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  npm-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 'lts/*'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm audit --audit-level=high || true
+
+

.nvmrc

@@ -0,0 +1,3 @@
+20
+
+

next.config.ts

@@ -4,11 +4,37 @@ import withPWA from 'next-pwa';
 const withPWANext = withPWA({
 	dest: 'public',
 	register: true,
-	skipWaiting: true
+	skipWaiting: true,
 });
 
-const nextConfig: NextConfig = {};
-
-export default withPWANext(nextConfig);
+const securityHeaders = (): { key: string; value: string }[] => {
+	const csp = [
+		"default-src 'self'",
+		"script-src 'self' 'unsafe-inline' 'unsafe-eval'",
+		"style-src 'self' 'unsafe-inline'",
+		"img-src 'self' data:",
+		"font-src 'self' data:",
+		"connect-src 'self' https://api.todoist.com",
+		"frame-ancestors 'none'",
+	].join('; ');
+	return [
+		{ key: 'Content-Security-Policy', value: csp },
+		{ key: 'Referrer-Policy', value: 'no-referrer' },
+		{ key: 'X-Content-Type-Options', value: 'nosniff' },
+		{ key: 'X-Frame-Options', value: 'DENY' },
+		{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
+	];
+};
 
+const nextConfig: NextConfig = {
+	async headers() {
+		return [
+			{
+				source: '/:path*',
+				headers: securityHeaders(),
+			},
+		];
+	},
+};
 
+export default withPWANext(nextConfig);

package.json

@@ -22,7 +22,8 @@
 		"e2e": "playwright test",
 		"e2e:ui": "playwright test --ui",
 		"e2e:install": "playwright install",
-		"lh:ci": "npx -y lighthouse http://localhost:3000 --quiet --budgets-path=./lighthouse-budgets.json --only-categories=performance --chrome-flags=\"--headless=new\""
+		"lh:ci": "npx -y lighthouse http://localhost:3000 --quiet --budgets-path=./lighthouse-budgets.json --only-categories=performance --chrome-flags=\"--headless=new\"",
+		"sec:audit": "npm audit --audit-level=high || true"
 	},
 	"dependencies": {
 		"@dnd-kit/core": "^6.3.1",