fix: escape newlines in CopyButton JS string

Valid finding from PR review: copy button's JS string could break
on values with newlines. Added \n and \r escaping.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -145,20 +145,13 @@ jobs:
     needs: [detect-changes]
     if: needs.detect-changes.outputs.agent == 'true'
     container:
-      image: docker:27-cli
+      image: alpine:latest
     steps:
-      - name: Build, push and trigger orca redeploy
+      - name: Trigger Coolify deploy
         run: |
-          apk add --no-cache git curl openssl
-          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-agent
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
-          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
-          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
+          apk add --no-cache curl
+          curl -sf "${{ secrets.COOLIFY_WEBHOOK_AGENT }}" \
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
 
   deploy-dashboard:
     name: Deploy Dashboard
@@ -166,20 +159,13 @@ jobs:
     needs: [detect-changes]
     if: needs.detect-changes.outputs.dashboard == 'true'
     container:
-      image: docker:27-cli
+      image: alpine:latest
     steps:
-      - name: Build, push and trigger orca redeploy
+      - name: Trigger Coolify deploy
         run: |
-          apk add --no-cache git curl openssl
-          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-dashboard
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
-          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
-          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
+          apk add --no-cache curl
+          curl -sf "${{ secrets.COOLIFY_WEBHOOK_DASHBOARD }}" \
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
 
   deploy-docs:
     name: Deploy Docs
@@ -187,20 +173,13 @@ jobs:
     needs: [detect-changes]
     if: needs.detect-changes.outputs.docs == 'true'
     container:
-      image: docker:27-cli
+      image: alpine:latest
     steps:
-      - name: Build, push and trigger orca redeploy
+      - name: Trigger Coolify deploy
         run: |
-          apk add --no-cache git curl openssl
-          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-docs
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.docs -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy docs"}}' "${GITHUB_SHA}")
-          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
-          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
+          apk add --no-cache curl
+          curl -sf "${{ secrets.COOLIFY_WEBHOOK_DOCS }}" \
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
 
   deploy-mcp:
     name: Deploy MCP
@@ -208,17 +187,10 @@ jobs:
     needs: [detect-changes]
     if: needs.detect-changes.outputs.mcp == 'true'
     container:
-      image: docker:27-cli
+      image: alpine:latest
     steps:
-      - name: Build, push and trigger orca redeploy
+      - name: Trigger Coolify deploy
         run: |
-          apk add --no-cache git curl openssl
-          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-mcp
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
-          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
-          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
+          apk add --no-cache curl
+          curl -sf "${{ secrets.COOLIFY_WEBHOOK_MCP }}" \
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"

Dockerfile.agent

@@ -44,4 +44,3 @@ RUN mkdir -p /data/compliance-scanner/ssh
 EXPOSE 3001 3002
 
 ENTRYPOINT ["compliance-agent"]
-

Dockerfile.dashboard

@@ -20,4 +20,3 @@ ENV IP=0.0.0.0
 EXPOSE 8080
 
 ENTRYPOINT ["./compliance-dashboard"]
-

Dockerfile.docs

@@ -12,4 +12,3 @@ RUN rm /etc/nginx/conf.d/default.conf
 COPY docs/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=builder /app/.vitepress/dist /usr/share/nginx/html
 EXPOSE 80
-

Dockerfile.mcp

@@ -14,4 +14,3 @@ EXPOSE 8090
 ENV MCP_PORT=8090
 
 ENTRYPOINT ["compliance-mcp"]
-

compliance-agent/src/main.rs

@@ -4,7 +4,7 @@ use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
     match dotenvy::dotenv() {
         Ok(path) => eprintln!("[dotenv] Loaded from: {}", path.display()),
-        Err(_) => eprintln!("[dotenv] No .env file found, using environment variables"),
+        Err(e) => eprintln!("[dotenv] FAILED: {e}"),
     }
 
     let _telemetry_guard = compliance_core::telemetry::init_telemetry("compliance-agent");