[edespino]

Change logs

The events page embeds the community Google Calendar. Chrome blocks that iframe because static/.htaccess sets frame-src and does not include calendar.google.com.

This adds https://calendar.google.com to frame-src only. No other directive changes.

Verified locally with the same iframe and the policy line from this file: the old policy shows "This content is blocked. Contact the site owner to fix the issue." The new policy loads Apache Cloudberry Community Calendar.

Contributor's checklist

• Clear title and commit message
• Local check of the blocked and allowed iframe
• Deployment preview

[edespino]

Round 1. Reviewer: Codex gpt-5.6-sol, xhigh, read-only. Reviewed SHA: d01b3f4.

REVIEW_VERDICT=APPROVE
REVIEWED_SHA=d01b3f419c3ee6ead204d36f6c98b24dd29db13a

Findings: None.

• static/.htaccess:37. The policy remains one Header set line. Its only policy change is adding https://calendar.google.com to frame-src.
• static/.htaccess:37. frame-src alone is sufficient for the Google Calendar iframe. The parent's script-src, connect-src, and default-src do not need the Calendar origin.
• static/.htaccess:30. The comment accurately describes the directive change.
• static/.htaccess:30. No secrets or unrelated edits were found.

END_OF_REVIEW

[edespino]

REVIEW_VERDICT=APPROVE

Codex gpt-5.6-sol xhigh, read-only, round 1. Reviewed SHA d01b3f4 matches the PR head. Findings: none. frame-src is the only policy change, and that host is enough for the calendar iframe.

Not merged. A merge to main runs Publish Cloudberry Site and updates cloudberry.apache.org. That publish needs a separate go.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

No open issues 🎉

What changed in this PR

Updates the site’s Content Security Policy to allow embedding the community Google Calendar, resolving Chrome iframe blocking on the events page.

Changes:

• Add https://calendar.google.com to the CSP frame-src directive.
• Update the inline policy documentation comments to reflect the new allowed embed source.

File	Description
static/​.htaccess	Extends CSP frame-src to include Google Calendar so the community calendar iframe can load.

_{Review effort: Lite}