fix: add missing CSP style-src nonce and include static SVGs in wheel

.gitea/workflows/release.yml

@@ -1,3 +1,6 @@
+# Release — Python package. Runs on version tags (v1.2.3) pushed to main.
+# Creates a Gitea release with wheel + sdist and publishes to PyPI.
+# Requires a PYPI_TOKEN secret (project-scoped upload token).
 name: Release
 
 on:
@@ -7,26 +10,27 @@ on:
 jobs:
   release:
     runs-on: fedora
+    permissions:
+      releases: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python and uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
         with:
-          python-version: "3.14"
+          python-version: "3.14" # match requires-python in pyproject.toml
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
       - name: Resolve and verify version
         id: version
         env:
-          REF: ${{ gitea.ref }}
+          VERSION: ${{ gitea.ref_name }}
         run: |
           set -euo pipefail
 
-          VERSION="${REF##*/}"
+          if ! echo "$VERSION" | grep -qE '^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$'; then
-          if [[ ! "$VERSION" =~ ^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$ ]]; then
+            echo "ERROR: expected a semver tag like v1.2.3, got: '$VERSION'"
-            echo "ERROR: expected a semver tag like v1.2.3, got: '$VERSION' (ref: '$REF')"
             exit 1
           fi
 
@@ -81,6 +85,7 @@ jobs:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
         run: |
           set -euo pipefail
           BODY="$(python -c 'import json,sys; print(json.dumps(sys.stdin.read()))' < release-body.md)"
@@ -90,18 +95,12 @@ jobs:
             -H "Content-Type: application/json" \
             -X POST \
             "${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases" \
-            -d "{
+            -d "{\"tag_name\":\"${GITEA_REF_NAME}\",\"name\":\"${GITEA_REF_NAME}\",\"body\":${BODY},\"draft\":false,\"prerelease\":false}")"
-              \"tag_name\": \"$GITHUB_REF_NAME\",
-              \"name\": \"$GITHUB_REF_NAME\",
-              \"body\": ${BODY},
-              \"draft\": false,
-              \"prerelease\": false
-            }")"
 
           http_code="$(echo "$response" | tail -1)"
           payload="$(echo "$response" | sed '$d')"
-          echo "HTTP ${http_code}"
 
+          echo "HTTP ${http_code}"
           if [ "$http_code" != "201" ]; then
             echo "Failed to create release: ${payload}"
             exit 1
@@ -114,10 +113,10 @@ jobs:
       - name: Upload wheel and sdist assets
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          VERSION_NO_V: ${{ steps.version.outputs.version_no_v }}
-          RELEASE_ID: ${{ steps.create.outputs.release_id }}
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
+          VERSION_NO_V: ${{ steps.version.outputs.version_no_v }}
+          RELEASE_ID: ${{ steps.create.outputs.release_id }}
         run: |
           set -euo pipefail
           for ASSET in "volumen-${VERSION_NO_V}-py3-none-any.whl" \
@@ -140,11 +139,7 @@ jobs:
             fi
           done
 
-          echo "Release $GITHUB_REF_NAME is live with wheel + sdist."
-
-      # Publish to PyPI (only on tag push). Requires `PYPI_TOKEN` in repo
-      # secrets (project-scoped upload token from https://pypi.org/manage/account/publishing/).
       - name: Publish to PyPI
-        if: startsWith(env.GITEA_REF_NAME, 'v')
+        env:
-        run: |
+          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}
-          uv publish --token "$PYPI_TOKEN"
+        run: uv publish

.gitea/workflows/test.yml

@@ -1,3 +1,6 @@
+# Test — Python. Runs on push and pull request to development. Never on main.
+# The 80 % coverage gate lives in pyproject.toml (addopts --cov-fail-under=80),
+# so `uv run pytest` enforces it here exactly as it does locally.
 name: Test
 
 on:
@@ -11,12 +14,12 @@ jobs:
   test:
     runs-on: fedora
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python and uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
         with:
-          python-version: "3.14"
+          python-version: "3.14" # match requires-python in pyproject.toml
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 

CHANGELOG.md

@@ -10,6 +10,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [development]
 
+## [0.4.1] — 2026-07-27
+
+### Fixed
+
+- **CSP nonce chybí pro `style-src` v admin routách** — přidán `style-src 'self' 'nonce-{nonce}'` do CSP hlavičky pro `/admin` routy. Bez nonce prohlížeč blokoval všechny inline `<style>` tagy v admin šablonách.
+- **`web/static/` SVG soubory chybí v distribučním kole** — přidána sekce `[tool.setuptools.package-data]` do `pyproject.toml`, aby `volumen-icon.svg` a `volumen-logo.svg` byly součástí instalovaného wheelu. Admin panel dříve vracel 500 na `/admin/icon.svg` a `/admin/logo.svg`.
+
 ## [0.4.0] — 2026-07-26
 
 ### Added

pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "volumen"
-version = "0.4.0"
+version = "0.4.1"
 description = "A small, file-based Markdown blog engine with a built-in admin."
 readme = "README.md"
 keywords = ["blog", "markdown", "fastapi", "cms", "static-blog", "toml", "rss", "json-feed", "engine"]
 requires-python = ">=3.14"
 license = {text = "MIT"}
-authors = [{name = "Petr Balvín", email = "petrbalvin@yandex.com"}]
+authors = [{name = "Petr Balvín", email = "opensource@petrbalvin.org"}]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Web Environment",
@@ -61,6 +61,9 @@ dev = [
 [tool.setuptools.packages.find]
 where = ["src"]
 
+[tool.setuptools.package-data]
+volumen = ["web/static/*"]
+
 
 [tool.ruff]
 line-length = 100

src/volumen/app.py

@@ -165,7 +165,13 @@ class GlobalSecurityHeadersMiddleware(BaseHTTPMiddleware):
         if request.url.path.startswith("/admin"):
             nonce = secrets.token_urlsafe(18)
             request.state.csp_nonce = nonce
-            csp = "; ".join(_BASE_CSP_DIRECTIVES + (f"script-src 'self' 'nonce-{nonce}'",))
+            csp = "; ".join(
+                _BASE_CSP_DIRECTIVES
+                + (
+                    f"script-src 'self' 'nonce-{nonce}'",
+                    f"style-src 'self' 'nonce-{nonce}'",
+                )
+            )
             response.headers["Content-Security-Policy"] = csp
 
         if self._cookie_secure:

uv.lock

@@ -897,7 +897,7 @@ wheels = [
 
 [[package]]
 name = "volumen"
-version = "0.4.0"
+version = "0.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "fastapi", extra = ["standard"] },