fix(static-assets): also cache-bust raw /static/ refs (fonts CSS, store JS)
All checks were successful
CI / ruff (push) Successful in 15s
CI / pytest (push) Successful in 2h47m7s
CI / validate (push) Successful in 33s
CI / dependency-scanning (push) Successful in 36s
CI / docs (push) Successful in 59s
CI / deploy (push) Successful in 1m53s

The initial codemod only converted url_for('*_static', path='*.js'|'*.css')
patterns and missed 19 raw /static/... references — most importantly the
shared/fonts/inter.css link in all four base.html files, plus a handful
of <script src="/static/modules/..."> tags in marketplace/billing/orders
templates and the storefront login/register/forgot/reset pages.

Result: deploys now flip ?v=<sha> on every JS/CSS asset that reaches the
browser, not just the ones loaded via url_for().

FE-024 rule extended to flag src="/static/...*.(js|css)" patterns too.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
2026-05-18 23:37:41 +02:00
parent 5f2885023c
commit 78e098d4da
21 changed files with 27 additions and 23 deletions

View File

@@ -937,7 +937,7 @@ frontend_component_rules:
- "{% from 'shared/macros/shop/trust-badges.html' import"
- id: "FE-024"
name: "Use static_v() for JS/CSS, not raw url_for()"
name: "Use static_v() for JS/CSS, not raw url_for() or /static/ paths"
severity: "warning"
description: |
Static .js and .css URLs must use the cache-busting `static_v()` helper
@@ -948,17 +948,20 @@ frontend_component_rules:
WRONG (browser keeps cached file after deploy):
<script src="{{ url_for('foo_static', path='admin/js/app.js') }}"></script>
<link href="{{ url_for('foo_static', path='admin/css/site.css') }}" rel="stylesheet">
<link href="/static/shared/fonts/inter.css" rel="stylesheet">
RIGHT:
<script src="{{ static_v(request, 'foo_static', path='admin/js/app.js') }}"></script>
<link href="{{ static_v(request, 'foo_static', path='admin/css/site.css') }}" rel="stylesheet">
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet">
Images, fonts, and JSON locale files are intentionally out of scope —
keep using `url_for()` for those.
Images, fonts (other than .css), and JSON locale files are intentionally
out of scope — keep using `url_for()` for those.
pattern:
file_pattern: "app/**/templates/**/*.html"
anti_patterns:
- "url_for\\(\\s*['\"]\\w+_static['\"]\\s*,\\s*path=['\"][^'\"]+\\.(?:js|css)['\"]"
- "(?:src|href)=['\"]/static/[^'\"]+\\.(?:js|css)['\"]"
exceptions:
- "base.html"
- "partials/"

View File

@@ -405,5 +405,5 @@
{% endblock %}
{% block extra_scripts %}
<script defer src="/static/modules/billing/store/js/billing.js"></script>
<script defer src="{{ static_v(request, 'billing_static', path='store/js/billing.js') }}"></script>
{% endblock %}

View File

@@ -7,7 +7,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>{{ _("auth.forgot_password") }} - {{ store.name }}</title>
<!-- Fonts: Local fallback + Google Fonts -->
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
{# CRITICAL: Inject theme CSS variables #}

View File

@@ -6,7 +6,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Customer Login - {{ store.name }}</title>
<!-- Fonts: Local fallback + Google Fonts -->
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
{# CRITICAL: Inject theme CSS variables #}

View File

@@ -7,7 +7,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Create Account - {{ store.name }}</title>
<!-- Fonts: Local fallback + Google Fonts -->
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
{# CRITICAL: Inject theme CSS variables #}

View File

@@ -7,7 +7,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Reset Password - {{ store.name }}</title>
<!-- Fonts: Local fallback + Google Fonts -->
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
{# CRITICAL: Inject theme CSS variables #}

View File

@@ -9,7 +9,7 @@
{% block alpine_data %}storeLetzshop(){% endblock %}
{% block extra_scripts %}
<script defer src="/static/modules/marketplace/store/js/letzshop.js"></script>
<script defer src="{{ static_v(request, 'marketplace_static', path='store/js/letzshop.js') }}"></script>
{% endblock %}
{% block content %}

View File

@@ -11,7 +11,7 @@
{% block alpine_data %}storeMarketplace(){% endblock %}
{% block extra_scripts %}
<script defer src="/static/modules/marketplace/store/js/marketplace.js"></script>
<script defer src="{{ static_v(request, 'marketplace_static', path='store/js/marketplace.js') }}"></script>
{% endblock %}
{% block content %}

View File

@@ -6,7 +6,7 @@
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Welcome to Orion - Setup Your Account</title>
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
<link rel="stylesheet" href="{{ url_for('static', path='store/css/tailwind.output.css') }}" />
<style>

View File

@@ -10,7 +10,7 @@
{% block alpine_data %}storeInvoices(){% endblock %}
{% block extra_scripts %}
<script defer src="/static/modules/billing/store/js/invoices.js"></script>
<script defer src="{{ static_v(request, 'billing_static', path='store/js/invoices.js') }}"></script>
{% endblock %}
{% block content %}

View File

@@ -6,7 +6,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Admin Login - Multi-Tenant Platform</title>
<!-- Fonts: Local fallback + Google Fonts -->
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
<link rel="stylesheet" href="{{ url_for('static', path='admin/css/tailwind.output.css') }}" />
<!-- Flag Icons CSS (for language selector) with local fallback -->

View File

@@ -6,7 +6,7 @@
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Select Platform - Admin Panel</title>
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
<link rel="stylesheet" href="{{ url_for('static', path='admin/css/tailwind.output.css') }}" />
<style>[x-cloak] { display: none !important; }</style>

View File

@@ -7,7 +7,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Merchant Login - Orion</title>
<!-- Fonts: Local fallback + Google Fonts -->
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
<link rel="stylesheet" href="{{ url_for('static', path='merchant/css/tailwind.output.css') }}" />
<!-- Flag Icons CSS (for language selector) with local fallback -->

View File

@@ -6,7 +6,7 @@
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Accept Invitation - {{ invitation.store_name if invitation else 'Store' }}</title>
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
<link rel="stylesheet" href="{{ url_for('static', path='store/css/tailwind.output.css') }}" />
<style>

View File

@@ -6,7 +6,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Store Login - Multi-Tenant Platform</title>
<!-- Fonts: Local fallback + Google Fonts -->
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
<link rel="stylesheet" href="{{ url_for('static', path='store/css/tailwind.output.css') }}" />
<style>

View File

@@ -7,7 +7,7 @@
<title>{% block title %}Admin Panel{% endblock %} - Multi-Tenant Platform</title>
<!-- Fonts: Local fallback + Google Fonts -->
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
<!-- Tailwind CSS v4 (built locally via standalone CLI) -->

View File

@@ -7,7 +7,7 @@
<title>{% block title %}Merchant Portal{% endblock %} - Orion</title>
<!-- Fonts: Local fallback + Google Fonts -->
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
<!-- Tailwind CSS v4 (built locally via standalone CLI) -->

View File

@@ -37,7 +37,7 @@
</style>
{# Fonts: Local fallback + Google Fonts #}
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
{# Tailwind CSS v4 (built locally via standalone CLI) #}

View File

@@ -35,7 +35,7 @@
<link
rel="stylesheet"
href="https://cdn.jsdelivr.net/npm/quill@2.0.2/dist/quill.snow.css"
onerror="this.onerror=null; this.href='/static/shared/css/store/quill.snow.css';"
onerror="this.onerror=null; this.href='{{ static_v(request, 'static', path='shared/css/store/quill.snow.css') }}';"
/>
<!-- Quill Dark Mode Overrides -->
<style>

View File

@@ -8,7 +8,7 @@
<title>{% block title %}Store Panel{% endblock %} - {{ store.name if store else 'Multi-Tenant Platform' }}</title>
<!-- Fonts: Local fallback + Google Fonts -->
<link href="/static/shared/fonts/inter.css" rel="stylesheet" />
<link href="{{ static_v(request, 'static', path='shared/fonts/inter.css') }}" rel="stylesheet" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
<!-- Tailwind CSS v4 (built locally via standalone CLI) -->

View File

@@ -1798,7 +1798,8 @@ class ArchitectureValidator:
return # Only report once per file
_STATIC_V_PATTERN = re.compile(
r"""url_for\(\s*['"]\w+_static['"]\s*,\s*path=['"][^'"]+\.(?:js|css)['"]\s*\)""",
r"""url_for\(\s*['"]\w+_static['"]\s*,\s*path=['"][^'"]+\.(?:js|css)['"]\s*\)"""
r"""|(?:src|href)=['"]/static/[^'"]+\.(?:js|css)['"]""",
re.IGNORECASE,
)