Gate the raw HTML that reaches the page

.github/CODEOWNERS

@@ -0,0 +1,58 @@
+# Code owners for pybcn/pybcn.github.io
+#
+# This site takes pull requests from outside contributors. A speaker edits
+# their own page under content/people/, which is fine and stays unowned so
+# that it needs no organizer.
+#
+# The paths below are different. A change there reaches every page of the
+# site, or reaches money, or reaches the deploy. Each one needs a review
+# from @pybcn/web.
+#
+# GitHub applies the last matching rule, and every rule here has the same
+# owner, so the order does not change the outcome.
+#
+# @pybcn/web has push access on this repository and its visibility is
+# "closed", which is what GitHub needs in order to send it a review request.
+# A secret team is a valid owner on paper and silently receives nothing.
+
+# Deploy. The workflow runs on every push and holds the publish credentials.
+/.github/                    @pybcn/web
+
+# Build and release scripts. They run on a maintainer machine.
+/bin/                        @pybcn/web
+
+# Site configuration. It sets the markup safety flags, the base URL and the
+# analytics identifier.
+/config.toml                 @pybcn/web
+
+# Layouts and shortcodes. A change here renders on many pages at once.
+#
+# layouts/shortcodes/membership/membership-process.html holds the PayPal
+# hosted_button_id of the association. One changed character in that value
+# sends the membership fees to another PayPal account, and the page still
+# looks correct. This is the strongest single reason this path is owned.
+/layouts/                    @pybcn/web
+
+# Static assets served from the site root, including files that browsers
+# fetch with no further checking.
+/static/                     @pybcn/web
+
+# The theme: every template, partial, script and stylesheet of the site.
+/themes/                     @pybcn/web
+
+# Association pages: statutes, the code of conduct, membership and payment
+# instructions. These carry legal and financial statements.
+/content/pybcn_association/  @pybcn/web
+
+# The custom domain of the GitHub Pages site. A change to this file points
+# pybcn.org somewhere else.
+/CNAME                       @pybcn/web
+
+# Sponsors and events. A sponsor file carries a name, a logo file name and the
+# tier it is listed under, and an event file decides which sponsors and which
+# people a page shows. Both render on pages an outside contributor never
+# touches, so a wrong value there is visible to everyone and obvious to
+# nobody. These are the paths a hostile sponsor entry would come through.
+/content/sponsors/           @pybcn/web
+/content/events/             @pybcn/web
+

.github/workflows/pr.yml

@@ -43,6 +43,9 @@ jobs:
       - name: Check front matter and cross-references
         run: bin/check-content
 
+      - name: Check content for dangerous raw HTML
+        run: bin/check-html-safety
+
   links:
     name: Check the links
     runs-on: ubuntu-latest

README.md

@@ -83,6 +83,40 @@ Once the site was archived, you can create a new link in the navigational menu u
 
 ## Information for developers
 
+### Content safety check
+
+`bin/check-html-safety` scans `content/` and fails if it finds raw HTML that
+turns a content change into script execution, a redirect, a credential prompt
+or a page overlay: `<script`, `<style`, `<iframe`, a `srcdoc=` attribute,
+`<object`, `<embed`, `<form`, `<meta`, `<link`, `<base`, an `on...=` event
+handler, a `style=` attribute (unless its value is only sizes and margins), and
+a `javascript:`, `vbscript:` or `data:` URL.
+
+It reads every file under `content/` that Hugo renders, not only markdown:
+`.org`, `.adoc`, `.rst` and `.pandoc` content can carry raw HTML too. Images and
+PDFs are skipped. A file with any other extension fails the check until the
+script lists it as text or as a binary asset. In each text file it reads the
+YAML front matter at any depth, both as raw text and after YAML decodes it, and
+the body.
+
+```
+pip install pyyaml
+./bin/check-html-safety
+```
+
+The `pr-checks` workflow (`.github/workflows/pr.yml`) runs it on every pull
+request.
+
+The `ALLOWLIST` at the top of the script is empty. The Google Form and Google
+Calendar embeds of the site go through the `google-embed` shortcode in
+`layouts/shortcodes/`, which checks the host and which an organizer reviews. To
+accept new third party markup, put it in a shortcode under `layouts/`. If an
+entry is unavoidable, it is keyed by file path, pattern and the prefix of the
+URL the element loads, so it permits one known embed and not any later one in
+the same file, and the file that carries it needs a rule in
+`.github/CODEOWNERS`, or any contributor can edit the allowed snippet.
+
+
 This is a work in progress. All the design and implementation decisions are detailed in [Proposta d'estructura](https://docs.google.com/document/d/10YxQeCuGQXUjnN3o9e1oH2HJkrhxJsr31qnxO_aiCNM/edit?usp=sharing) (currently written in catalan). All the tasks are managed through our [private Trello board](https://trello.com/b/cFE8KRTS).
 
 For now, we are not looking for contributors yet.
@@ -171,7 +205,42 @@ Each event in the list can indicate:
 - the color of the event in the calendar: red, orange, yellow, green, blue, purple (defaults to orange)
 - the location where the event will take place (a room, or a url)
 - the topic of the event (e.g. Data Science, Security...)
-- the type of the event: talk, workshop, coffee, lunch, group, qa, lightning
+- the type of the event: talk, workshop, coffee, lunch, photo, group, qa, lightning
+- `python_level` and `topic_level`: the experience the attendee needs. Use one
+  of `beginner`, `intermediate` or `advanced`
+
+#### Experience levels
+
+`python_level` and `topic_level` take a token, never markup. The site renders
+each token as a badge with a coloured dot and the matching text label, so the
+level does not depend on colour alone:
+
+| Token | Label | Dot |
+|---|---|---|
+| `beginner` | Beginner | green |
+| `intermediate` | Intermediate | amber |
+| `advanced` | Advanced | red |
+
+An unknown token prints as plain text and logs a build warning. The tokens and
+the labels live in `themes/pybcn_theme/layouts/partials/level_badge.html`.
+
+#### Agenda legend
+
+`legend` is a list of items, not an HTML string. Each item is one of:
+
+```
+legend:
+  - type: workshop        # any event type, plus "sponsor" for the gold star
+    label: Hands-on       # optional, overrides the default label
+  - type: talk
+  - separator: true       # a visual group break
+  - level: beginner
+  - level: intermediate
+  - level: advanced
+```
+
+The icons and the default labels come from
+`themes/pybcn_theme/layouts/partials/event_types.html`.
 
 ```
 spansDuration: 20