Refactor: Build File Signatures

[DawoudIO]

What Changed

• Replace Grunt generateSignatures with Node script;
• move signatures to src/admin/data;
• run integrity checks fresh (remove persistent integrityCheck.json)

Type

• ✨ Feature
• 🐛 Bug fix
• ♻️ Refactor
• 🏗️ Build/Infrastructure
• 🔒 Security

Testing

Screenshots

Security Check

• Introduces new input validation
• Modifies authentication/authorization
• Affects data privacy/GDPR

Code Quality

• Database: Propel ORM only, no raw SQL
• No deprecated attributes (align, valign, nowrap, border, cellpadding, cellspacing, bgcolor)
• Bootstrap CSS classes used
• All CSS bundled via webpack

Pre-Merge

• Tested locally
• No new warnings
• Build passes
• Backward compatible (or migration documented)

[Copilot]

Pull request overview

This PR refactors the build signature generation process by replacing the Grunt-based task with a standalone Node.js script, relocating the output file from src/signatures.json to src/admin/data/signatures.json, and modifying how integrity check results are cached in AppIntegrityService.

Key Changes:

• New Node.js script at scripts/generate-signatures-node.js replaces Grunt generateSignatures task
• Signature file moved to src/admin/data/signatures.json (from src/signatures.json)
• AppIntegrityService now runs integrity checks fresh instead of reading from persistent integrityCheck.json cache

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
scripts/generate-signatures-node.js	New standalone Node.js script for generating SHA1 file signatures
src/ChurchCRM/Service/AppIntegrityService.php	Removes persistent cache reading, always runs fresh verification, updates signature file path
package.json	Updates deploy script to use Node script instead of Grunt task; reorders dependency
Gruntfile.js	Removes deprecated generateSignatures task definition
.gitignore	Updates signature file path to new location
.codespellrc	Updates signature file path in skip list

[Copilot]

The script writes to src/admin/data/signatures.json without ensuring the directory exists first. fs.writeFileSync() will throw an error if the parent directory doesn't exist. Consider adding directory creation before writing:

const outDir = path.dirname(outFile);
if (!fs.existsSync(outDir)) {
  fs.mkdirSync(outDir, { recursive: true });
}
fs.writeFileSync(outFile, JSON.stringify(signatures));

Suggested change

	const outDir = path.dirname(outFile);
	if (!fs.existsSync(outDir)) {
	fs.mkdirSync(outDir, { recursive: true });
	}

[Copilot]

The exclusion pattern for thumbnails has changed from the Grunt version. The old Grunt task excluded only !Images/Person/thumbnails/*.jpg (specific file extension), but this new pattern excludes the entire Images/Person/thumbnails/ directory regardless of file type.

If there are any .php or .js files legitimately stored in this directory, they will now be excluded from integrity checks when they weren't before. Consider matching the original Grunt behavior more precisely:

/^Images\/Person\/thumbnails\/.*\.jpg$/,

Suggested change

	/^Images\/Person\/thumbnails\//,
	/^Images\/Person\/thumbnails\/.*\.jpg$/,

[Copilot]

This PR removes the code that reads from integrityCheck.json, but other parts of the codebase still use this file:

1. src/ChurchCRM/Service/SystemService.php (line 102-104) still writes to integrityCheck.json during background jobs
2. src/ChurchCRM/tasks/IntegrityCheckTask.php (line 15-21) still reads from integrityCheck.json to determine if a task should be shown

This creates an inconsistency where:

• Background jobs write to a file that AppIntegrityService no longer reads
• IntegrityCheckTask depends on a file that may not be reliably populated
• The change is incomplete - either all components should use the file or none should

Consider either:

• Reverting this change to keep using the cached file consistently, OR
• Updating SystemService.php to remove writing the file and updating IntegrityCheckTask.php to call AppIntegrityService directly