drop SRI + integrity checks, pin assets/styles.css to stable filename, skip Mermaid in minify-dist

[Copilot]

Summary

Per user direction: "Need no sha and integrity checks, all code/script/css on s3/cloudfront is trusted" + "Never want strange css filenames, only standard filename. NO strange generated changing suffixes".

This PR removes the vite-plugin-sri-gen + update-sri.ts integrity-rewrite pipeline end-to-end, pins the main CSS bundle to a canonical, non-hashed filename (assets/styles.css), and hardens the deploy-time minify pass against the vendored Mermaid chunk graph.

Why now

PR #2428 added a deploy-time purge-css → minify → update-sri pipeline that mutates CSS / JS bytes after Vite has already content-hashed filenames and stamped SRI integrity into 4 911 HTML pages. Result:

• Every redeploy rewrites the bytes behind the same hashed assets/styles-<hash>.css URL → any browser holding HTML in cache (max-age=3600) has stale integrity="sha384-OLD" ≠ new bytes → SRI blocks the stylesheet → unstyled page until force-reload.
• Same class of bug invalidated 504 modulepreload integrities across 24 hashed JS chunks.
• The hashed CSS filename meant https://riksdagsmonitor.com/assets/styles.css 404'd for any external consumer (CloudFront fell back to index.html).
• Vendored Mermaid chunks under js/lib/mermaid/ were re-minified by coderaiser/minify (their basenames don't carry .min.), risking subtle breakage of the carefully-rolled chunk graph.

Per the repo's "trust S3 / CloudFront" platform classification — already documented in vite.config.js and scripts/strip-legacy-chrome-script-tags.ts — first-party assets do not require browser-side SRI; integrity is enforced by TLS + bucket policy + CloudFront WAF.

Changes

Phase A — stable CSS URL & no SRI

• vite.config.js — assetFileNames pins styles.css → assets/styles.css (no content hash). vite-plugin-sri-gen removed from the plugin chain.
• scripts/vite-plugin-static-pages.js — rewrites href="styles.css" → assets/styles.css (relative-aware), no longer injects integrity / crossorigin on <link rel="stylesheet"> tags. Module-script rewrite preserved.
• scripts/purge-css.ts — targets dist/styles.css, dist/assets/styles.css (canonical), and dist/assets/styles-*.css (legacy hashed, for back-compat with older fixtures).
• scripts/deploy-s3.sh — ships assets/styles.css with cache-control: public, max-age=3600, must-revalidate (ETag handles updates); legacy dist/styles.css fallback preserved when present.

Phase B — Mermaid hardening

• scripts/minify-dist.ts — adds path-based SKIP_SUBPATHS (js/lib/mermaid) so the Mermaid chunk graph (chunk-*.mjs, no .min. marker) is never re-minified.

Phase D — remove update-sri end-to-end

• scripts/update-sri.ts — deleted (-393 LOC).
• .github/workflows/deploy-s3.yml — update-sri.ts step removed; comment updated to point at the new canonical CSS filename.
• package.json + package-lock.json — vite-plugin-sri-gen removed.

Tests

• tests/vite-plugin-static-pages.test.ts — full rewrite. Asserts no integrity / crossorigin on CSS link, stable assets/styles.css rewrite, legacy hashed-bundle back-compat fallback when stable bundle absent. All script-rewrite regression coverage preserved.
• tests/css-purge-and-minify.test.ts — covers all 3 purge targets (root + stable + legacy hashed); new minify-dist test asserts js/lib/mermaid/chunk-*.mjs is byte-identical after the pass; wiring test asserts update-sri.ts step is gone in the workflow YAML; entire update-sri describe block (5 tests, ~230 LOC) removed.
• tests/dashboard-bundle-integrity.test.ts — asserts href="../assets/styles.css" (stable) and rejects regression to legacy hashed filename.

Validation

Check	Result
npx vitest run	5 495 passed, 30 skipped, 0 failed
npx eslint scripts/ tests/ vite.config.js	0 errors
npx tsc -p tsconfig.scripts.json --noEmit	clean
npm run build	4 911 HTML pages emitted, dist/assets/styles.css present, 0 integrity= attrs in dist/index.html
Synthetic minify-dist.ts run on js/lib/mermaid/chunk-FAKE.mjs	byte-identical (skipped via path filter)

Note on the original Phase C

The original PR plan included a Phase C (--size-only on HTML/metadata sync passes). I deliberately omitted it because mutable HTML can change without size change (translations, retitle, retag), and silently missing same-size content edits is a worse failure mode than re-uploading unchanged HTML. Happy to add if you confirm the trade-off is acceptable.

Out of scope

• Per-page Lighthouse "unused CSS" of ~200 KiB is real (the safelist keeps ~75 % of the bundle). Fixing that requires per-page code-splitting, deferred to a separate PR.
• Auto-regenerated analysis/daily/**/article.md and political-intelligence_*.html files appear in the diff because npm run build re-runs prebuild scripts that stamp generated_at / og:updated_time timestamps. These are timestamp-only churn — no semantic regression — and were committed by the standard report_progress flow.

[github-actions]

🔍 Lighthouse Performance Audit

Category	Score	Status
Performance	85/100	🟡
Accessibility	95/100	🟢
Best Practices	90/100	🟢
SEO	95/100	🟢

📥 Download full Lighthouse report

Budget Compliance: Performance budgets enforced via budget.json

[github-actions]

🏷️ Automatic Labeling Summary

This PR has been automatically labeled based on the files changed and PR metadata.

Applied Labels: documentation,dependencies,html-css,javascript,workflow,translation,rtl,ci-cd,deployment,performance,testing,refactor,size-xl,news

Label Categories

• 🗳️ Content: news, dashboard, visualization, intelligence
• 💻 Technology: html-css, javascript, workflow, security
• 📊 Data: cia-data, riksdag-data, data-pipeline, schema
• 🌍 I18n: i18n, translation, rtl
• 🔒 ISMS: isms, iso-27001, nist-csf, cis-controls
• 🏗️ Infrastructure: ci-cd, deployment, performance, monitoring
• 🔄 Quality: testing, accessibility, documentation, refactor
• 🤖 AI: agent, skill, agentic-workflow

For more information, see .github/labeler.yml.

[github-actions]

🔍 Lighthouse Performance Audit

Category	Score	Status
Performance	85/100	🟡
Accessibility	95/100	🟢
Best Practices	90/100	🟢
SEO	95/100	🟢

📥 Download full Lighthouse report

Budget Compliance: Performance budgets enforced via budget.json

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.