docs: update FORK.md with 9 new divergences, fix CodeQL badge, rename e2e workflow (#27)

.github/workflows/e2e-issue-981.yml

@@ -1,4 +1,4 @@
-name: e2e issue-981 checkboxes DADict
+name: End-to-end test suite
 
 # Proves the fix in docassemble_webapp/docassemble/webapp/interview/helpers.py
 # end to end against the real server: POST /api/session with a plain dict for

FORK.md

@@ -45,6 +45,51 @@ Branch `jacob/maintained` is the working branch. It tracks
   fallback. Implementation in `docassemble/base/email_crypto.py`.
 - **Clearer API error**: when a plain dict still breaks assembly, the error
   names the variable and links `session_post_objects`.
+- **SEO head tags, canonical, sitemap** (#15): `standard_html_start` emits a
+  `<meta name="description">`, a `<link rel="canonical">` derived from the URL
+  root (suppressible via `canonical: False`), and Open Graph tags for
+  ungated pages; a `/sitemap.xml` route lists every public interview.
+  CI: `Issue-15 control` (expect-fail on release) →
+  `Issue-15 - install head builder and sitemap route` (expect-pass).
+- **a11y skip link, 404 landmark, print CSS** (#18): a skip-to-content link
+  is injected before the main region, the 404 page gains a `<main>`
+  landmark and a home link, and `@media print` rules hide chrome.
+  CI: `Issue-18 control` (expect-fail) →
+  `Issue-18 - install a11y templates, CSS, and interview page` (expect-pass).
+- **FontAwesome CSS build, page weight** (#19): the 1.5 MB FontAwesome JS
+  bundle is replaced by a CSS + webfont build (~350 KB), cutting ~1.1 MB
+  from every page load.
+  CI: `Issue-19 control` (expect-fail, JS bundle present) →
+  `Issue-19 - install FontAwesome CSS build` (expect-pass, weight drops).
+- **NFC normalisation in pdftk.py** (#21): fill values are normalised to
+  NFC before the XFDF write so combining characters (e.g. NFD accents
+  from macOS input) render correctly in the filled PDF.
+  CI: `NFC control` (expect-fail, combining accent lost) →
+  `NFC - install this branch's pdftk.py` (expect-pass).
+- **geopy lazy-load** (upstream #932): `geopy` is imported on first use
+  instead of at module load, so a broken pydantic chain in a transitive
+  dependency cannot prevent the server from starting.
+  CI: container boot in the e2e workflow exercises the import path.
+- **safe_join path containment** (CodeQL path-injection): every
+  Playground, package-read/write, project rename/create, and
+  package-setup site now routes through `werkzeug.utils.safe_join` (or
+  an equivalent guard), closing path-traversal vectors flagged by
+  CodeQL's `security-extended` queries.
+  CI: CodeQL advanced scan (`.github/workflows/codeql.yml`).
+- **tar-slip fix** (CodeQL): `PyPI package extraction` validates that
+  every member path stays inside the target directory before extraction,
+  closing a tar-slip (Zip-slip variant) write-wherever.
+  CI: CodeQL advanced scan (`.github/workflows/codeql.yml`).
+- **ReDoS fix** (CodeQL polynomial-redos): nine polynomial-redos regexes
+  across package setup, filename parsing, and hostname validation are
+  rewritten with proven-equivalent linear-time alternatives
+  (`re.split`, `rstrip`, non-backtracking patterns).
+  CI: CodeQL advanced scan (`.github/workflows/codeql.yml`).
+- **Open redirects fix** (CodeQL): two redirect sites that accepted a
+  user-supplied URL now validate the target against an allow-list of
+  safe schemes and same-origin hosts before issuing the `Location`
+  header.
+  CI: CodeQL advanced scan (`.github/workflows/codeql.yml`).
 - **PDF choice options**: editable fills preserve paired export/display
   options and selection indices; a temporary display-label projection lets
   QPDF render labels while the saved PDF retains its canonical export values.

README.md

@@ -1,4 +1,4 @@
-[![CodeQL](https://github.com/jacobyoby/docassemble/actions/workflows/github-code-scanning/codeql/badge.svg?branch=jacob%2Fmaintained)](https://github.com/jacobyoby/docassemble/security/code-scanning)
+[![CodeQL](https://github.com/jacobyoby/docassemble/actions/workflows/codeql.yml/badge.svg?branch=jacob%2Fmaintained)](https://github.com/jacobyoby/docassemble/security/code-scanning)
 [![e2e](https://github.com/jacobyoby/docassemble/actions/workflows/e2e-issue-981.yml/badge.svg?branch=jacob%2Fmaintained)](https://github.com/jacobyoby/docassemble/actions/workflows/e2e-issue-981.yml)
 [![Dependabot](https://img.shields.io/badge/Dependabot-security_updates-025e8c?logo=dependabot)](https://github.com/jacobyoby/docassemble/security/dependabot)
 [![Secret scanning](https://img.shields.io/badge/secret_scanning-push_protection-2da44e)](https://github.com/jacobyoby/docassemble/security)