reframe/netlify.toml at main · reframe-oss/reframe · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
# Netlify configuration for Reframe
#
# Reframe is a statically exported Next.js app (`output: "export"` in
# next.config.ts), so Netlify serves the prerendered `out/` directory. There is
# no server runtime and no Next.js Runtime plugin involved.

[build]
  # Bun is pre-installed in Netlify's build image, but Netlify's automatic
  # package-manager detection keys off `bun.lockb`, and this repo uses the newer
  # text-format `bun.lock`. Rather than depend on detection, install explicitly.
  # Source maps are built for the Datadog upload in CI, then removed here so
  # they are never served publicly (scripts/strip-sourcemaps.mjs).
  command = "bun install && bun run build && node scripts/strip-sourcemaps.mjs out"

  # `output: "export"` writes the static site here.
  publish = "out"

[build.environment]
  NODE_VERSION = "22"
  # Matches the version used in local development. Remove this line to track
  # whatever Bun ships in Netlify's build image.
  BUN_VERSION = "1.4.0"

# ─────────────────────────────────────────────────────────────────────────────
# Security headers
#
# These mirror vercel.json exactly, so the site behaves identically on both
# hosts. If you change one file, change the other.
#
# The last two are load-bearing, not hygiene:
#
#   Cross-Origin-Opener-Policy: same-origin
#   Cross-Origin-Embedder-Policy: require-corp
#
# Together these make the page cross-origin isolated, which is what enables
# SharedArrayBuffer. src/lib/ffmpeg.worker.ts branches on `self.crossOriginIsolated`
# and loads @ffmpeg/core-mt (multi-threaded) when it is true, falling back to the
# single-threaded @ffmpeg/core when it is false. Without these headers the app
# still works, but every export runs single-threaded and is markedly slower —
# a silent performance regression, not a visible error.
#
# COEP require-corp does not break FFmpeg core loading: the worker fetches the
# core from cdn.jsdelivr.net using an explicit CORS `fetch()`, which jsdelivr
# serves with permissive CORS headers.
# ─────────────────────────────────────────────────────────────────────────────

[[headers]]
  for = "/*"
  [headers.values]
    X-Frame-Options = "DENY"
    X-Content-Type-Options = "nosniff"
    Referrer-Policy = "strict-origin-when-cross-origin"
    Permissions-Policy = "camera=(), microphone=(), geolocation=()"
    Strict-Transport-Security = "max-age=31536000; includeSubDomains"
    Cross-Origin-Opener-Policy = "same-origin"
    Cross-Origin-Embedder-Policy = "require-corp"
    Cross-Origin-Resource-Policy = "same-origin"
    # No fetch directives (script-src, connect-src …), so nothing the app
    # loads (the FFmpeg cores, Datadog RUM) can be blocked; it only stops
    # framing, plugins, <base> hijacking and off-site form posts.
    Content-Security-Policy = "base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'"

# Hashed build assets never change, so browsers may keep them for a year.
# Declared here rather than relying on @netlify/plugin-nextjs, which was what
# set this before: a deploy without the plugin served them with max-age=0.
[[headers]]
  for = "/_next/static/*"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

# The service worker (public/sw.js) must always be re-checked, or browsers
# keep running an old one after a deploy. Its content changes with every
# build (scripts/build-sw-manifest.mjs), which is how updates are noticed.
[[headers]]
  for = "/sw.js"
  [headers.values]
    Cache-Control = "no-cache"