Merge dev to stable

.editorconfig

@@ -9,3 +9,12 @@ insert_final_newline = true
 max_line_length = 120
 tab_width = 2
 trim_trailing_whitespace = true
+
+[{*.json,*.jsonc}]
+insert_final_newline = false
+
+[{*.yaml,*.yml}]
+insert_final_newline = false
+
+[*.html]
+insert_final_newline = false

.env.example

@@ -20,13 +20,9 @@
 #?
 #? You should remove the comment on variable lines only if you want to set the variable.
 
-##########
-## SERVER:
-##########
-## Address to bind the server to. [[::]]:string
-#? ("[::]", "[::1]", "127.0.0.1", ...)
+## Hostname to bind: [::]:string
 #JSPF_BIND_ADDRESS=[::]
 
-## Listen port for the server. [3000]:integer
+## Port to bind: [3000]:integer<0-65535>
 #? Port 0 selects a random port.
 #JSPF_PORT=3000

.github/renovate.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended", "customManagers:biomeVersions"],
+  "extends": ["config:recommended"],
   "lockFileMaintenance": {
     "enabled": true,
     "automerge": true

.github/workflows/cd.yml

@@ -42,17 +42,17 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: "audit"
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: "false"
 
       - name: Setup mise-en-place
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
 
       - name: Save context
         id: ctx
@@ -119,7 +119,7 @@ jobs:
 
       - if: inputs.artifact-action == 'build-release'
         name: Attest artifact
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: |
             dist/*.tar.xz
@@ -129,23 +129,18 @@ jobs:
     if: github.repository_owner == 'jspaste' && inputs.image-action != 'none'
     name: Release container image
     runs-on: ubuntu-latest
-    outputs:
-      tags: "${{ steps.image.outputs.tags }}"
-      digest: "${{ steps.release.outputs.digest }}"
-      registries: "${{ steps.release.outputs.registries }}"
-
     permissions:
       packages: write
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: "audit"
 
       - name: Setup podman
         env:
-          PODMAN_VERSION: "v5.8.2"
+          PODMAN_VERSION: "v5.8.7"
         run: |
           sudo apt-get purge -y podman runc crun conmon
 
@@ -161,7 +156,7 @@ jobs:
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: "false"
 
@@ -176,7 +171,7 @@ jobs:
           echo "sha_short=${CTX_SHA::7}" >>"$GITHUB_OUTPUT"
 
       - name: Login to GHCR
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: "ghcr.io"
           username: "${{ github.repository_owner }}"
@@ -194,7 +189,6 @@ jobs:
 
       - if: inputs.image-action == 'build-release'
         name: Release container image
-        id: release
         env:
           GHA_TAG: "${{ steps.image.outputs.tags }}"
           GHA_REGISTRY: "ghcr.io docker.io"
@@ -203,28 +197,3 @@ jobs:
           GHA_REGISTRY_ACCOUNT_NAME: "${{ github.repository_owner }} ${{ secrets.DOCKER_USER }}"
           GHA_REGISTRY_ACCOUNT_TOKEN: "${{ secrets.GITHUB_TOKEN }} ${{ secrets.DOCKER_TOKEN }}"
         run: ./.github/scripts/release-container.sh
-
-  container-attest:
-    if: github.repository_owner == 'jspaste' && inputs.image-action == 'build-release'
-    name: Attest container image
-    runs-on: ubuntu-latest
-    needs: container-release
-    strategy:
-      matrix:
-        registry: ${{ fromJson(needs.container-release.outputs.registries) }}
-
-    permissions:
-      attestations: write
-      id-token: write
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: "audit"
-
-      - name: Attest image
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-name: "${{ matrix.registry }}/jspaste/frontend"
-          subject-digest: "${{ needs.container-release.outputs.digest }}"

.github/workflows/ci.yml

@@ -25,17 +25,17 @@ jobs:
       sha_short: ${{ steps.ctx.outputs.sha_short }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: "audit"
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: "false"
 
       - name: Setup mise-en-place
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
 
       - name: Save context information
         id: ctx
@@ -80,7 +80,7 @@ jobs:
     needs: test
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -91,7 +91,7 @@ jobs:
           path: "./dist/frontend/"
 
       - name: Deploy preview
-        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_PAGES_TOKEN }}
           command: >-

.gitignore

@@ -1,11 +1,7 @@
 *
 
 !/.github/
-!/.github/renovate.json
-!/.github/scripts/
-!/.github/scripts/*.sh
-!/.github/workflows/
-!/.github/workflows/*.yml
+!/.github/**
 !/.zed/
 !/.zed/settings.json
 !/public/

CONTRIBUTING.md

@@ -18,21 +18,18 @@ The project uses `mise` to manage scripts. To list all available scripts..:
 mise run
 ```
 
-Scripts are grouped, meaning that a script such as `task run build` will run
+Scripts are grouped, meaning that a script such as `mise run build` will run
 other scripts under its name to fulfil its function, in this case building the
 frontend and compiling the server.
 
 This may not be desired in every case, so it is recommended that scripts be run
 in a more granular way..:
 
 ```shell
-# Bad
-mise run build:frontend build:server start:server
+# Build and start
+mise run build:server start:server
 
-# Good, we don't need to compile a binary
-mise run build:frontend start:server
-
-# Better, we can run the development server with HMR
+# Better, we can run the development server
 mise run start:dev
 ```
 
@@ -47,8 +44,7 @@ Building the Frontend is very straightforward..:
 mise run build
 ```
 
-It will prepare a standalone production binary ready to be run in
-`dist/server(.exe)`.
+It will prepare a standalone production binary ready to be run in `dist/`.
 
 You can also avoid constantly rebuilding the server and build frontend instead
 or the other way around..:

README.md

@@ -1,6 +1,6 @@
 # Frontend
 
-The web based editor for JSPaste.
+Client-side lightweight web editor
 
 ## Supported Browsers
 
@@ -13,27 +13,27 @@ Please do not open issues with older browsers than those listed:
 *Last checked:
 [`1bab598`](https://github.com/jspaste/frontend/commit/1bab5981b4ce47c43d64c873a7224fbd79e9aafa) on 5 November 2025*
 
-## Installation
+## Setup
 
-### Binaries
+### Binary
 
-1. Download the [latest release](https://github.com/jspaste/frontend/releases/latest) and extract it to a new folder
-2. Copy `.env.example` to `.env` and configure it
-3. Run the binary:
+- Download the [latest release](https://github.com/jspaste/frontend/releases/latest) and uncompress it to a new folder
+- Edit the `.env.example` file and rename it to `.env`
+- Run the binary...
 
-**Linux & macOS:**
+Linux & macOS:
 
 ```shell
 ./server
 ```
 
-**Windows:**
+Windows:
 
 ```powershell
 powershell -c ".\server.exe"
 ```
 
-### Container images
+### Container
 
 We publish images to multiple registries for redundancy:
 
@@ -47,39 +47,25 @@ docker pull docker.io/jspaste/frontend:latest
 docker run --env-file=.env -d -p [::1]:3000:3000 docker.io/jspaste/frontend:latest
 ```
 
-## Security
+## Validate
 
 > [!IMPORTANT]
-> Only binaries and container images built from the official GitHub `JSPaste/Frontend` repository
-> are considered secure by the JSPaste developers.
+> All artifacts and images originate from GitHub `JSPaste/Frontend` repository, no other artifacts or images built and
+> distributed outside that repository are considered secure nor trusted by the JSPaste team.
 
-All attestations can be manually checked at [JSPaste Attestations](https://github.com/jspaste/frontend/attestations).
+You can verify the integrity and origin of an artifact using the GitHub CLI or manually at
+[JSPaste Attestations](https://github.com/jspaste/frontend/attestations).
 
-### Binaries
-
-With [GH-CLI](https://cli.github.com).
-You must verify the tarball, not its content:
-
-```shell
-gh attestation verify ./frontend_latest_linux-amd64.tar.xz --owner jspaste
-```
-
-### Container images
-
-With [GH-CLI](https://cli.github.com).
-Since version
-[`2024.05.19-c3f18d0`](https://github.com/jspaste/frontend/pkgs/container/frontend/218171024?tag=2024.05.19-c3f18d0),
-container images are also attested:
+Artifacts are attested and can be verified using the following command:
 
 ```shell
-gh attestation verify oci://docker.io/jspaste/frontend:latest --owner jspaste
+gh attestation verify ./frontend_latest_linux-amd64.tar.xz --owner JSPaste
 ```
 
-## Contributing
+## Development
 
-See [`CONTRIBUTING`](CONTRIBUTING.md) for more details.
+See the [`CONTRIBUTING`](CONTRIBUTING.md) file for more details.
 
 ## License
 
-This project is licensed under the European Union Public License (EUPL).
-See [`LICENSE`](LICENSE) for more details.
+This project is licensed under the EUPL License. See the [`LICENSE`](LICENSE) file for more details.