From eef784ac6a72a8223fe094f79c72d58d8d91a4d0 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Sat, 18 Apr 2026 13:09:09 +0300 Subject: Address Copilot review: preconnect order + staging-gate cookies-policy script MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two fixes flagged by the Copilot reviewer on #35: 1. Preconnect hints were appended to the end of while the GTM loader is prepended to the top, so GTM's async script creation fired before the browser ever saw the preconnect tags — they provided no benefit. Switches insert-preconnect-hints to prepend_child and adds `after = "insert-google-tag-manager-head"` so the widget runs after GTM and its prepend pushes GTM down to position 1. Result: preconnects land at the top of , ahead of the GTM loader. 2. The Cookiebot cd.js script embedded directly in site/legal/cookies-policy.md rendered on every profile, so a staging visitor who hit /legal/cookies-policy/ would leak their IP to consent.cookiebot.com. Replaces the inline + diff --git a/soupault.toml b/soupault.toml index 7c41812..8d1e6de 100644 --- a/soupault.toml +++ b/soupault.toml @@ -78,7 +78,22 @@ height="0" width="0" style="display:none;visibility:hidden"> """ selector = "head" - action = "append_child" + action = "prepend_child" + after = "insert-google-tag-manager-head" + profile = "live" + +# The Cookiebot CookieDeclaration script is injected only on live builds so +# staging visitors who hit /legal/cookies-policy/ don't leak their IP to +# consent.cookiebot.com. The markdown source contains a placeholder div +# (#cookie-declaration-placeholder) that this widget replaces in place. +[widgets.insert-cookiebot-declaration] + widget = "insert_html" + page = "legal/cookies-policy.md" + html = """ + +""" + selector = "#cookie-declaration-placeholder" + action = "replace_element" profile = "live" # Inserts a scary warning banner in preview versions -- cgit v1.2.3