chore(static-site): sync certified-assets v0.4.0 - #402
Merged
Merged
Conversation
Bump @dfinity/static-site to v0.4.0 across skills; document raw hosts skipping verification, the dual ic_env Set-Cookie, the v0.3.x -> v0.4.0 reinstall, and third-party state-hash verification.
Skill Validation ReportProject Checks |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The runnable root icp.yaml still pins @dfinity/static-site@v0.3.3, leaving the sync incomplete.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
Syncs static-site documentation and evaluations with certified-assets v0.4.0.
Changes:
- Updates recipe pins and migration guidance.
- Adds raw-host security, cookie, and state-hash verification guidance.
- Adds regression evaluations and upstream metadata.
| File | Summary |
|---|---|
skills/static-site/SKILL.md |
Updates v0.4.0 guidance; root icp.yaml still needs its recipe pin updated, and one wording nit remains. |
skills/static-site/references/migrating-from-asset-canister.md |
Updates the migration recipe. |
skills/service-discoverability/SKILL.md |
Updates the static-site recipe example. |
skills/icp-cli/SKILL.md |
Updates recipe references and examples. |
skills/icp-cli/references/dfx-migration.md |
Updates migration mapping. |
skills/deploy-to-cloud-engine/SKILL.md |
Updates the deployment example. |
evaluations/static-site.json |
Adds raw URL and state-hash evaluation cases. |
.claude/upstream.md |
Records the v0.4.0 upstream sync. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
marc0olo
marked this pull request as ready for review
September 23, 2026 08:32
marc0olo
enabled auto-merge (squash)
September 23, 2026 08:33
lwshang
approved these changes
Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs
static-siteto certified-assets v0.4.0. Closes #396.Most upstream doc changes are editorial (frontmatter, em-dashes). Substantive ones applied:
v0.3.3→v0.4.0in every skill that pins it (static-site,icp-cli,service-discoverability,deploy-to-cloud-engine). Pitfall 11 now statesv0.3.x→v0.4.0is breaking (pre-1.0 minor) and needs a reinstall.rawhosts skip verification (new Pitfall 14):<id>.raw.icp.netforwards responses unverified and the canister cannot refuse it; with access protection, arawlink exposes testers to a spoofable login page. Link<id>.icp.netonly.ic_envarrives as twoSet-Cookieheaders (Lax+None; Partitioned).state-hashfrom the canister's release tag with--locked, compare withstate_hash '()' -n ic -o hex; zero hash = unfinished sync;ic_envand access protection are outside the hash.Verified end-to-end on a local v0.4.0 deploy:
version/state_hashcalls and the dualic_envcookie behave as documented, andstate-hashbuilt from thev0.4.0tag reproduces the canister's hash exactly.Eval results (2 new cases + re-run of case 6, whose pitfall was edited)
Baseline failures:
icp0.iodomain instead oficp.net; never mentions the unverified login page / token-harvesting risk.sha256sumanddfx canister infoinstead ofstate-hash+state_hash.icp deploy --mode reinstall, no breaking-vs-patch distinction.