[gitluis]

On hold — draft on purpose. Part of the v2.0 — Public launch milestone. Leave this open until the app is more mature, renamed and on a custom domain. Mark it "Ready for review" when you want to merge it.

Summary

Adds GitHub Actions checks that run on every pull request (whatever branch it targets, so stacked PRs are checked too) and on every push to master. The app itself doesn't change.

Job	What it checks	Fails when
JavaScript syntax	node --check on every js/*.js and the inline <script> in index.html	Any file has a syntax error
CDN scripts (SRI)	Each CDN <script> with integrity has crossorigin, and its hash matches what the CDN serves today	A hash is wrong, crossorigin is missing, or the CDN can't be reached

Scripts without integrity (Chart.js, PapaParse, Day.js on master today) are a warning, not a failure. #22 adds SRI to all of them. Once it merges, set MISSING_IS_ERROR = True in .github/scripts/check_sri.py.

Version: v2.0.0 (CHANGELOG, index.html footer, README, Settings → General, CLAUDE.md §1).

Why no ESLint (yet)

FinLens shares one global scope across files by design, so ESLint's most useful rule (no-undef) would flag every cross-file call unless we list hundreds of globals. It would also add an npm config file to a no-npm project. node --check catches what actually breaks the app (syntax errors) with no config. Worth revisiting if the code moves to modules.

How it was tested

• check_syntax.py run locally on this branch: all 16 JS files and the inline script pass.
• check_sri.py: the CDN is blocked from my workspace, so I checked the hashing against the same files from npm (marked@15.0.12, dompurify@3.4.17). Both match the integrity values in index.html. The live CDN download is only verified by the Actions run on this PR.
• Not tested: a deliberately broken hash on GitHub (see step 4 below).

Manual testing (step by step)

1. Open this PR's Checks tab. Two jobs should be listed: JavaScript syntax and CDN scripts (SRI), both green.
2. Open CDN scripts (SRI) and expand its step. You should see ok for marked and DOMPurify, and three yellow warnings for Chart.js, PapaParse and Day.js.
3. Open JavaScript syntax. Every js/ file and index.html (inline script 1) should say ok.
4. (Optional, proves it catches mistakes) On a scratch branch, change one character of the marked integrity hash in index.html and push. The SRI job should fail with "SRI hash mismatch" and show both hashes. Delete the scratch branch afterwards.
5. Open index.html locally and check the sidebar footer and Settings → General both say v2.0.0.

Please check before merging

• Both jobs green on this PR
• Version v2.0.0 isn't taken by anything merged before this (renumber if so)
• If v1.10.6: Content Security Policy + SRI on every CDN script #22 has merged: flip MISSING_IS_ERROR to True
• Optional: in Settings → Branches, require these two checks on master (possible now the repo is public)

https://claude.ai/code/session_013Z8iBUNj6C627mxmm1CurV

---

Generated by Claude Code