Migrate from Cloudflare Pages to Vercel and remove Cloudflare dependencies - #20
Merged
Conversation
…ncies - Add vercel.json translating _headers (preserving the deliberate must-revalidate caching on app.js/style.css/manifest.json) - Self-host pdf.js 3.11.174 and SheetJS 0.18.5 under public/vendor/, verified against npm's published sha512 integrity before extracting. Updates index.html, app.js's workerSrc, and sw.js's cache list; drops SRI attributes since the files are now same-origin - Remove Cloudflare Turnstile entirely: it had no server-side verification anywhere, so it was pure client-side friction. Removes the script loader, the verification gate in processFile (renamed processPDFAfterVerification to processPDF), the widget markup, its CSS, and the unused security-verification i18n strings - Add Vercel Analytics; the footer already claimed 'anonymous usage analytics' with no beacon actually present, so this also makes that claim true rather than just renaming it - Delete _worker.js, _headers, _redirects, .cfignore - Rewrite check-cdn-versions.sh: verifies the vendored files exist and are referenced consistently, since there is no longer a cdnjs version path to check. Remove the now-dead Renovate custom manager and its cdnjs packageRule (this does mean losing automated upstream update tracking for pdf.js and SheetJS; the CI check still catches drift between the three files that reference them) - Rewrite README.md's tech stack, layout, security and deployment sections for Vercel
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates hosting from Cloudflare Pages to Vercel, and removes every remaining Cloudflare-origin runtime dependency (not just hosting). The site is no longer connected to any Cloudflare product.
vercel.jsontranslatespublic/_headers, preserving the deliberatemust-revalidatecaching onapp.js/style.css/manifest.json(a long max-age on those unfingerprinted files previously froze a stale build at the edge for a year)public/vendor/, downloaded from npm's registry and verified byte-for-byte against npm's own signed sha512 integrity metadata before extracting. Updatesindex.html,app.js'sworkerSrc, andsw.js's cache list; SRI attributes dropped since the files are same-origin nowsiteverifyanywhere in the repo, so it was pure client-side friction with zero security value. Removes the script loader, the verification gate inprocessFile(renamedprocessPDFAfterVerificationtoprocessPDF), the widget markup, its CSS, and the unusedsecurity-verificationi18n strings_worker.js,_headers,_redirects,.cfignoredeletedscripts/check-cdn-versions.shrewritten to verify the vendored files are present and consistently referenced (there is no longer a cdnjs version path to check); the now-dead Renovate custom manager and its cdnjs packageRule are removedKnown tradeoff, flagged for a decision
Vendoring pdf.js and SheetJS means losing Renovate's automated upstream update tracking for them. The CI check still catches drift between the three files that reference them, but won't tell you when a new upstream version ships. Accept that, or add them as npm dependencies with a small build step to keep tracking — open question.
Verification done
*.cloudflare.comhostcheck-version-sync.shand the rewrittencheck-cdn-versions.shboth pass