Skip to content

Host the H5P build page and the library bundles at /h5p/ - #8

Merged
alekswebnet merged 2 commits into
mainfrom
feat/h5p-build
Nov 10, 2026
Merged

alekswebnet merged 2 commits into
mainfrom
feat/h5p-build

Conversation

@alekswebnet

@alekswebnet alekswebnet commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

Closes #7.

The H5P build page and the library bundles move here from embed-my.github.io, in this site's own look.

Was Now
embed-my.github.io/build /h5p/build/
embed-my.github.io/bundles/ /h5p/bundles/

What changed

  • src/h5p/build/, the page. Its two scripts are embed-my's, unchanged except the stylesheet import and the comments: its styles are now the site's own, a section of site.css. The markup keeps every id and text, inside the docs header's brand, theme switch and footer. The heading is now "Build an H5P activity", the same as the tab title, so it fits on two lines on a phone.
  • vite.config.ts. It runs after Eleventy (pnpm build is tsc && eleventy && vite build). It bundles the page's script with the player, its runtime and the library pack into /h5p/assets/, with the runtime's licence and notice and the pack's licence list beside them. It writes /h5p/bundles/ as embed-my does. _site/ is Eleventy's too, so it empties only the folders it writes.
  • The player's Service Worker lands in /h5p/assets/, so its scope is /h5p/assets/h5p/. The home page and the pdfjs-viewer docs are outside it, and a test checks the scope.
  • base.njk writes an optional csp front-matter value as a <meta> policy, first in <head>. An Eleventy transform adds the hash of each inline script on such a page to script-src, so the policy covers the site's inline color-scheme script too, as embed-my's Vite plugin does for its pages. The build page sets embed-my's policy.
  • The theme switch's markup moves to theme-switch.njk, which the docs layout now includes. The home page's and the docs' HTML are byte-identical before and after.
  • CI: build.yml now runs the browser tests on pull requests. pages.yml is unchanged, and the pnpm build it runs now writes /h5p/ too.
  • Size: _site/ grows from 13 MB to 143 MB: the bundles are 113 MB and the page's assets 17 MB, well within Pages' 1 GB.

Tests

Seven Playwright tests run against the built site:

  • embed-my's five tests for the page and its two for the bundles, at the new paths;
  • new checks that the page has its policy, that site.js runs under it (the theme switch shows), and that the worker's scope is /h5p/assets/h5p/.

All pass locally and in CI. Screenshots in light and dark at 1280 and 390 px were checked, and none had a console error.

Mutation checks:

  • Without the transform's hash, the browser refuses the inline script and the first test fails.
  • The test's PNG is now a valid one (the old one failed its CRC and zlib check), and the test checks the picture reaches the content. Chromium decoded the old PNG too, so this assertion can't tell the two apart.

Review

cubic's four findings, in 5f4902d:

  • the policy first, with hashes;
  • the valid PNG;
  • the README calling embed-my's redirect a step of its own;
  • unzip documented as a prerequisite of pnpm e2e, answered in its thread.

Merge order

  1. This PR first.
  2. Once it is deployed, embed-my's PR that turns /build into a redirect carrying #source=.
  3. Then the h5p-author skill's addresses in h5p-offline-player.

embed-my keeps serving /bundles/ until the next pack release, for copies of the skill installed before the move.


Summary by cubic

Hosts the H5P build page and the library bundles at /h5p/build/ and /h5p/bundles/, moved from embed-my.github.io and now styled like the rest of this site.

  • Vite bundles the page's script with the player, runtime, and library pack into /h5p/assets/, where the Service Worker's scope covers only that folder.
  • base.njk gains an optional csp front-matter value, emitted as a <meta> policy first in <head>; an Eleventy transform hashes each inline script into script-src, since GitHub Pages sends no headers.
  • Adds seven Playwright tests: the page builds, plays, and downloads sources pasted or carried in a link's fragment, and /h5p/bundles/ builds a quiz in an empty folder. build.yml now runs them on pull requests.
  • _site/ grows to 143 MB, within Pages' 1 GB limit.

Migration

  • Existing links with #source= fragments keep working; embed-my's /build will redirect here once this is deployed.
  • embed-my keeps serving /bundles/ until the next pack release, for copies of the h5p-author skill installed before the move.

Written for commit 5f4902d. Summary will update on new commits.

View guided diff Turn on auto-fix

The build page and the bundles move here from embed-my.github.io's /build and
/bundles/, as /h5p/build/ and /h5p/bundles/, the page in this site's own
layout and palette. Eleventy writes the pages, then Vite bundles the page's
script with the player, its runtime and the library pack into /h5p/assets/,
so the player's Service Worker is scoped to /h5p/assets/h5p/ and no other
page is under it. The bundles are written at build, as embed-my writes them.

The theme switch moves into an include the docs layout shares; the docs'
HTML is unchanged byte for byte. base.njk takes an optional csp.

Closes #7
@socket-security

socket-security Bot commented Nov 10, 2026 •

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 18 files

Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic

Comment thread src/_includes/base.njk Resolved
Comment thread README.md Resolved
Comment thread e2e/build.spec.ts Resolved
Comment thread e2e/bundles.spec.ts Resolved
- base.njk writes a page's Content-Security-Policy first in <head>, before the
  inline color-scheme script, and an Eleventy transform adds each inline
  script's hash to script-src, so the policy covers every script on the page.
- The test PNG's IDAT failed its CRC and zlib check; it is a valid 2x2 red
  PNG now, and the test checks the picture reaches the content.
- The README describes embed-my's /build redirect as a step of its own, and
  says the bundles test runs unzip, as the skill's steps do.
@alekswebnet
alekswebnet merged commit 687a53f into main Nov 10, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Host the H5P build page and the library bundles at /h5p/

1 participant