From 7c3207b4f24985f9866e4852d5bbc4b4d142bef1 Mon Sep 17 00:00:00 2001
From: sinedied <noda@free.fr>
Date: Wed, 10 Jun 2026 15:19:30 +0200
Subject: [PATCH 1/2] fix: restore dual-origin base href while keeping it
 parameterized

PR #173 replaced runtime hostname-based base href detection with a
build-time hardcoded BASE_HREF, which forced the single deployed
artifact to always use /moaw/. This broke serving from the moaw.dev
custom domain (served at root /), where assets and routes resolved to a
non-existent /moaw/ path.

Restore the runtime .github.io detection so the same build works from
both moaw.dev (/) and *.github.io/moaw/ (/moaw/), while still
parameterizing the sub-path value via BASE_HREF (defaulting to /moaw/)
so the platform can be hosted in other repositories.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/deploy.yml           | 1 +
 packages/website/scripts/update-env.sh | 3 +++
 packages/website/src/public/404.html   | 2 +-
 packages/website/src/public/index.html | 2 +-
 4 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 7f241b33..d0088b29 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -35,6 +35,7 @@ jobs:
       run: npm run build:website
       env:
         SEARCH_URL: ${{ secrets.SEARCH_URL }}
+        BASE_HREF: /moaw/
     - name: Setup GitHub Pages
       uses: actions/configure-pages@v4
     - name: Upload artifact
diff --git a/packages/website/scripts/update-env.sh b/packages/website/scripts/update-env.sh
index 42c861ed..37c2ace2 100755
--- a/packages/website/scripts/update-env.sh
+++ b/packages/website/scripts/update-env.sh
@@ -16,8 +16,11 @@ fi
 dist_folder="dist/website"
 version="sha.$(git rev-parse --short HEAD)"
 ai_search_url="${AI_SEARCH_URL:-}"
+base_href="${BASE_HREF:-/moaw/}"
 
 perl -i -pe "s/__VERSION__/$version/g" $dist_folder/main.*.js
 perl -i -pe "s/__AI_SEARCH_URL__/$ai_search_url/g" $dist_folder/main.*.js
+perl -i -pe "s|__BASE_HREF__|$base_href|g" $dist_folder/index.html $dist_folder/404.html
 
 echo Version: $version
+echo Base href: $base_href
diff --git a/packages/website/src/public/404.html b/packages/website/src/public/404.html
index 9bcb9dcd..e996a930 100644
--- a/packages/website/src/public/404.html
+++ b/packages/website/src/public/404.html
@@ -4,7 +4,7 @@
   <!-- Workaround for GitHub Pages not supporting SPA routing -->
   <script>
     sessionStorage.redirect = location.href;
-    const url = window.location.hostname.includes('.github.io') ? '/moaw/' : '/';
+    const url = window.location.hostname.includes('.github.io') ? '__BASE_HREF__' : '/';
     window.location.replace(url);
   </script>
 </head>
diff --git a/packages/website/src/public/index.html b/packages/website/src/public/index.html
index 28da1960..572bfc07 100644
--- a/packages/website/src/public/index.html
+++ b/packages/website/src/public/index.html
@@ -7,7 +7,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <script>
     if (window.location.hostname.includes('.github.io')) {
-      window.document.head.getElementsByTagName('base')[0].href = '/moaw/';
+      window.document.head.getElementsByTagName('base')[0].href = '__BASE_HREF__';
     }
   </script>
   <link rel="icon" type="image/png" href="favicon.png">

From a5b74d30056d144daabd8949367fbfb916237e60 Mon Sep 17 00:00:00 2001
From: Yohan Lasorsa <noda@free.fr>
Date: Wed, 10 Jun 2026 15:55:36 +0200
Subject: [PATCH 2/2] fix: potential fix for pull request finding 'CodeQL /
 Incomplete URL substring sanitization'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 packages/website/src/public/404.html | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/website/src/public/404.html b/packages/website/src/public/404.html
index e996a930..723bd86f 100644
--- a/packages/website/src/public/404.html
+++ b/packages/website/src/public/404.html
@@ -4,7 +4,9 @@
   <!-- Workaround for GitHub Pages not supporting SPA routing -->
   <script>
     sessionStorage.redirect = location.href;
-    const url = window.location.hostname.includes('.github.io') ? '__BASE_HREF__' : '/';
+    const hostname = window.location.hostname;
+    const isGitHubPagesHost = hostname === 'github.io' || hostname.endsWith('.github.io');
+    const url = isGitHubPagesHost ? '__BASE_HREF__' : '/';
     window.location.replace(url);
   </script>
 </head>