From b3b2903c751e2dbff1e3dc70f08b8419e2180f1c Mon Sep 17 00:00:00 2001
From: Uwe Schuster <mail@uwe-schuster.info>
Date: Sat, 25 Apr 2026 21:38:19 +0200
Subject: [PATCH] =?UTF-8?q?#3:=20inject-hashed-filenames.py=20=E2=80=94=20?=
 =?UTF-8?q?tag-aware=20HTML=20rewrite?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace substring `html.replace(old_src, new_src)` with a regex anchored
to <script src="…"> / <link href="…"> attribute values. Inert occurrences
in comments, JSON literals, or unrelated attributes are left alone.

Loud warning (stderr) when zero matches occur — previously the script
silently skipped a typo'd old_src.

Also rewrites <link href> in the same pass so adjacent CSS hashing doesn't
need a follow-up edit.

Tests: tests/test_inject_hashed_filenames.py covers happy path (both quote
styles, extra attributes), inert-substring cases (comment, JSON literal,
data-attr, anchor href), and link-href rewriting.

Closes #3

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../inject-hashed-filenames.cpython-313.pyc   | Bin 0 -> 5284 bytes
 bin/inject-hashed-filenames.py                |  34 +++++++-
 ...hed_filenames.cpython-313-pytest-8.3.5.pyc | Bin 0 -> 13931 bytes
 tests/test_inject_hashed_filenames.py         |  77 ++++++++++++++++++
 4 files changed, 107 insertions(+), 4 deletions(-)
 create mode 100644 bin/__pycache__/inject-hashed-filenames.cpython-313.pyc
 create mode 100644 tests/__pycache__/test_inject_hashed_filenames.cpython-313-pytest-8.3.5.pyc
 create mode 100644 tests/test_inject_hashed_filenames.py

diff --git a/bin/__pycache__/inject-hashed-filenames.cpython-313.pyc b/bin/__pycache__/inject-hashed-filenames.cpython-313.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..4a92e1485ed335d7dc236afc84ce325cc5eebbbd
GIT binary patch
literal 5284
zcmbVQUvL}68Q+sm(&_Za@xRy!7_SwFSZQnn`9q=_Lz)mLkT^jX;WTm(XXz{}k?zFa
z$xaN+c<2nZ`7?F`)S7mtqf9%4dFgc8&J?B(4W(uJs9;0P)ej8hg@?{Kb*Aa$so$=2
zvLXm+*|B%;cEA1h`?tUEJFWSAB7!Ei{xkKA523H<i`9hk!`l1s@D7p?K@um~p5_S0
zMjNrQ(N64a<Owg?haD0xId<`qb2B>26Q|^Y89FPl756Sd64{DN^1zI@yvj>9Sn;tH
zLE?wqyKIu5y@|sfsV;O1A-NTyVLl9fZ401bF@ScLr+0Iu2aJ-oq%F81*JMX1tW1!U
zq2R+Oj~&H&oTRb_Hsqv^4Gm|tlxkqvz|R83HXV=2`k0cyS)wI!aU-RvcqFGL(n^mg
zMszu;ghY%}>RBajbeBlGM^kA<l{1Rolf8fs93MP%WFYpGbbJs;e-t@#^kD4Zk?<K&
ztX@dzSjJh|7^4Enm=RMhIGxgsl$ylGn1U76ASs2(NJ{ee;FDvDsK>{YjEplWLNo%)
zKx#~AAU8>L$F&5=ZtWaZCbaGeWkk+qVL5?E<a4kJ>cXL_sK_LpQV1Sbh)&hiMu8Vd
zR<ch>1U)g1vL53X%Ol2tjI5?c72ODgU_GE4vXP4SCP47so^dc?ueIKDR@c<Pj`fXW
zMkdWRQO4HBl$ub^_pqfZQZ1c`=_FpF4)j(Z0?GjAK$-2!)~0(2n9PC5-(Sqq_Ww!P
zs*~7bca6kMatMh1=`@Q0hy|ixqUc(B9Na^cG+1;ToT}kU{NS#HGAifN1`7x3a-w84
zOf=09<C<#7Db)%acpXh8F%2h(<}C1r@Q#lG1^)8YOZfTD6GI1|5B7*((|a;#y2_?D
zokTHmM4hZ7O3w+|FchLjb%UIVmoF5%R!->QKB2WK=-xq5=u0hZv!2$+002f61;4&x
zJq1t%Sr@h&CM6r~tM<_IYTEAdNu4NYADrCP)z|fSs1&j<rBmv;;P6QFx&AZTA0Hl}
z3nc#17*R%p!}|8e;6EA|-gYK9>FO#y1bNd&6w?*gGFh;f=~VQ%oK;Nm$iU$7@RJAj
zOHT$lLKW7j6|lLtcTCGDy~&i(Te?@>uwir*Y}h-JQhV=?3#LCdl1o8U!>y;LB_80{
zK^cdjn?g4Q<n_;nUJES?kFSW{+2Cuzxq(IT{u_4A-S&mpbi-kDH{Wz3w`bNj<6Cn(
zyv|kRa5&dsH!^v8e@vIEOwe01S!d+3X@z=k2fgiQ;#32xQ8zFb9)gGGY~aL-gCm^f
z4Ama7hpTs$cSmfyIEe#f7Qk`qj<8L>8fMXhyQmCQnjJW<<y0dGm?bB><q3$x5Z2W6
z1&CY*#yajRBQc2Fk9);F>OM@p)emqC*f)|h6nzI)6+kGg=SDyu8sr(-00h)QGdLoX
zf$-L`Mi_|p+!3r)(?<ATI{{rk_YMSGxT0%WAsD2J)+ad{es`g=S+=1xEcm{r%)X{p
z2y&()Nwi!xXfwGC@xzo(=kXMw3Dy+)(sE`bA@`e`EGX|wYjHWP_xD&!57SNU(EVo$
z6*}JCc6r-E$FH_8Ok54@dB6V8Eg!U8ssGdFPXY&s7ifYu7C<HsW>JGY@xdI6Q+BrL
zDo2@4O@Q(9xFm+Fd^p(z(^L(eMj)IAfmPR*A6oQpof=s7G|cwR^ewd>xN>sQ^Hh<4
zik)csEL^7{JZ8G7liA}P(M7|WMc2=uzZXD+9Y9^v)&ZfbyppH`NN`zX5*I;!w6o$3
z$n({JQI1KAnvUOkO2y}QImH&?zHy4%;<_%Q4XO4htD)FQ)HO8?AkJ<@j>=0=M@f~N
zgV7Kl2JLE_Rm(J@!(Sn!IwFp6eJu^dZG~?|2hjf5eGtJ=g;CS0&MGMVHp|f4QPUz7
z%leVzh&aItcGVSK*S%snsym=Wa}5J{wd7ZYT79D}7WI&DYTNEI!sI}<?9U^j<Ybjz
z;0}MgBDOvo$RbdWNba4EXr%@WZ??FtkCM30h7pU3Dw!pZg;r&$+tznjPZ77}C(OK5
z?Wgtli%?m-5f}8nhzPwO<gN=%K!plgNE?oGQa#Kz>=f3yQE5CN(>fQa@taZHfp(yZ
zCjnYUL63IWh0y>v*!-Bi9gT8#ry2asJt^WPieS^=WV3!Ql?`E412ipFbF>1UtglSd
z+fAoTS4w{p3egKDPb&(O>m@XhCVPhVhX)yhJ5U^OxEjV8R8!2J<SAU|AT|;Ha_ViI
zR^)Ly&x+oh3gwBKR1)uT<N=^Cxe1`}?#Gih+%@UJT0EX3P{za+La%|z=_Yi+$<~Ur
zWf`F!nxN+d>r9)bn>+(5r*a-@Q{8lAA$u4muVoe0<Y{ec@@Y*@n9gxI4aK2pPb!A#
zN~8#_<xQR_a)JS+Y1c34rc*Z(3L&P0C9j}|(AXnXA%?pqH);x&Elmflz%Q82(gy;=
zWCqcuV5LXX!P28n@e-<GtCeutS*jz*K3LoZ|N1n9!xUQa_+}rSd33gara#|(&C_+&
z)3qY_iW{~TGKE;tzk5m8vn=?lse;!$omV}bjH;s$EZkT0cP|M&l*;X!&Mdj_FK{c3
zE%W;>?aM#&R^PO6%Z|jhFX}hVw_j}ktUfU9SgvcDy)bhjzv)`tmaBDJKKC{)*KeE~
zzt}eITxo8ZAG$a+AG;VU3@tWy7n^z(<lj0M&KDc@PP<lo^>e{DVg+uwv1xwK#XWEB
zojwTM{cYDbcN97oT#K9c&D2c`%bpE$`(F=T_tq~rJaMJvL(eMWj&d89H@443i};7D
zcCP-h>&>n6r!SuVmy7rLZ-~g($av?aC0|G3nPsnUc3@^;?(mYgjq(p%7kqOqbMAao
zKAHb<VPv6s!L{(>m92k&_@nI~>@0>)7DJI@<k_NsXh}Hrx!}LC4K-}J*@YZp(c4)#
zQ#f7}cYVt5zSRwe_{@F(?OT43`OVnvTN{D*r@oHcdM9|~!$(>Uwb(y;sQysU@i$My
zp^)R_7V*%7u8)J_p-0^xhr|KF9S6EfqgX`IZtXB!pX!<`O0N@ZVVbOKnuQ?}7is{6
zfxKOXA-1Z$Ld`~amFyG=lUx<mx13PU6jfE=chgr%^fpKY8RWa^C5~pI<4yO<l9imn
zMJpNcjy!9NZm@I=gDq+s<k?E*Qth>QXUGn@RDz7iM=SZNN}`Rm+@NZpHBwDG)g(En
zHdZeAUL2g&93s5rV(&CIpkZ_@f>^Fd3g3bCV`U_F4-#sM$$dHY%LHKG|NFZH!LXmf
zDxpYIRY=mf4Ejtv{I)?Jf@hPLNphUf3`J<IO19ETCxB*rB0++5W;^YEKs$<D<U!~F
zY2o*kpu-g6qsemRSo#nGpd~vgg^PkE{Lo=?icW38u&@M#d<H&S$pM%=3IF<s&;bm(
z#5Z=%?w#5Dlb7dSSah{gbn_osIw4&<ar)|s)1L^@<+=?kbq%xUXU^xjnHQ%Hue1k#
zz4P6@m-qhS<%Jg(+aG${J}+Dp^7WTIe;D~=>UXK%pPM>D0dee&2l5ZEG;Ev?UJB;-
zzqMo9Me(rpD__$zw*r_6UuXa|vqxu+<~J42UOu+yedNx$(aT2`y*&U))2W%G|90_i
z@diLr^QsqleYfg?)te98)@hOWm(48)8|{B>6c2W|Od%Gddd6a4ZdWXp(BiRJ$(Gc_
zgnk2;JYa_}AXfLYyu^%b+99bi3sE*SbH!pN4=K-h53#!4`T)tm&sk}upF9oRAe$il
zm(T&ca@-BRmE+eQL7ev=$j$!5Ri~SC<`1kQ7>b>{Z_;tKmFJ%3=C-UNIu`7uaUotB
zi+cucvV~QD8@DG9R4^=*hWCLM-mdUB>9G0)=jVLW@tX*S)d1qX)02z#P0PINr-xrT
TJah8(XFuheR_%!2%;f(sEzWHK

literal 0
HcmV?d00001

diff --git a/bin/inject-hashed-filenames.py b/bin/inject-hashed-filenames.py
index 0afdddc..2cb2d21 100755
--- a/bin/inject-hashed-filenames.py
+++ b/bin/inject-hashed-filenames.py
@@ -26,9 +26,29 @@ containing the config file's parent chain → `$PWD`).
 """
 import json
 import os
+import re
 import sys
 
 
+def _build_pattern(old_src: str) -> "re.Pattern[str]":
+    # Match `src` on <script> and `href` on <link>, single- or double-quoted.
+    # We anchor to the tag name so an `old_src` substring sitting inside an
+    # HTML comment, a JSON literal, or a `data-…` attribute is not rewritten.
+    return re.compile(
+        r'(<(?:script|link)\b[^>]*?\b(?:src|href)\s*=\s*["\'])'
+        + re.escape(old_src)
+        + r'(["\'])',
+        re.IGNORECASE,
+    )
+
+
+def rewrite(html: str, old_src: str, new_src: str) -> "tuple[str, int]":
+    """Return (new_html, count). Tag-aware: only rewrites <script src> /
+    <link href> attributes, never substring matches in comments or JSON."""
+    pattern = _build_pattern(old_src)
+    return pattern.subn(lambda m: m.group(1) + new_src + m.group(2), html)
+
+
 def inject(manifest_path: str, html_path: str, old_src: str) -> None:
     if not os.path.exists(manifest_path):
         print(f"skip: no manifest at {manifest_path}")
@@ -45,12 +65,18 @@ def inject(manifest_path: str, html_path: str, old_src: str) -> None:
         new_src = f"{os.path.dirname(old_src)}/{hashed}"
         with open(html_path) as f:
             html = f.read()
-        if old_src not in html:
-            print(f"skip: {old_src!r} not in {html_path}")
+        new_html, count = rewrite(html, old_src, new_src)
+        if count == 0:
+            # Loud warning — silent skip used to mask typos in `old_src`.
+            print(
+                f"WARN: no <script src> or <link href> matching {old_src!r} "
+                f"in {html_path} — leaving file unchanged",
+                file=sys.stderr,
+            )
             return
         with open(html_path, "w") as f:
-            f.write(html.replace(old_src, new_src))
-        print(f"{old_src} -> {new_src}")
+            f.write(new_html)
+        print(f"{old_src} -> {new_src} ({count} occurrence{'s' if count != 1 else ''})")
         return
     print(f"skip: no isEntry row in {manifest_path}")
 
diff --git a/tests/__pycache__/test_inject_hashed_filenames.cpython-313-pytest-8.3.5.pyc b/tests/__pycache__/test_inject_hashed_filenames.cpython-313-pytest-8.3.5.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..ca48ab92b4e92afea22797bc76168cc9ea4c1b14
GIT binary patch
literal 13931
zcmeHO&2!tv6$eO&pAz+H$+4XTW<Dg=A*oN>NhHS|$BvW6PD+@KC)NxMl8^+20+<CD
zS?V;FGR??7#hz)$Zcpx^9jT`rdh37C6KN@xiu904PdRj^wGW-~sqbL{khCa8YOPew
z5F!`*cHb@*3-I^e{`To%OG}7><M6@1EANLH=5HuCN0Xg-$aom$myEy=MqmZck67Zd
z&fd2;-NQ3)H4z_AYy2c&)dWe<I)_MTJecZsI;@;iPgU|xZVS!BPJQJ(9vNY&<eW+C
z7Ojs~S~<BbH0zD1)#+dG3fzd7_CVUl1F7eo-YVx*Zzb>Kgr@QK5tuzZNY@taj?wz+
zbiB*CGU*=g9uK7w)wMJ)G~oruyHfp|>rz9T%f`E%KH+Kk4l(4A;D_|E5P<ZE5QOw;
zAq43&LKxC#g=R>3p#{>Tlb%?l_&!YfC0RFgenKOBMp2WBIxT07_>`ni$+`H1l9yF!
zM%ELBIiAR~L^0&P7~l8YP%IG&y{o9IoZ~a{l=P9J70D~SF(o@{yrT1lG#Qs>B_i`*
zFZ_bn)chQObyUw1rC{(n$&N+8Uie+~)Ky+mbD^uFc}4wzpCa-^rQ9%xk|`Q8|B;k0
z$~uo-5xJ0;vT`oLzp2W^;I(YFNQkUvp<bK7A%wJi4*Ta7l|O&!!rOdSo0*YSLw|{X
zOL*rZpNG33QXWLO>7q*Hykx+ANY2%Cex|4!a9^RkJYn!sUQ=bh5AUr&WV}<IzdB{i
z<P-K#uJW^z&g;dD4#QO^;~BV<98AzR_{1)nUYOVULt9U*=~bpCvei%54+6fL4?~c`
z&y-b}D{g(tereqT$fOy;BY2(Hxd^Xkp+n%b!L;|4^9-ZC-e)W4e#<adIHzUG=j1Bq
zC?hnbxnWlDU4CxZGh*us{wo1TCuPBlBhhn|8L<mqg>w#m;8j;?uGK{;%A`HctLuzS
z0#K=H71_SkJ1mT;awqk*z0Ng+K*AG;yH%Tnpb$zo^|O}byVCAlrK+zEr>t^@@%o&;
zoU_ad%otlZBZReq|7xB)tLC}+iO)0ZjCWV_?6!h=Zmyb}|KU7OGO?D6^T%rNBdHsb
zp=6UeMK_XCp^%u?qo+ob6k<+2>a0`$=+LG@DU%%-9D=srpbc7KA9=>cR@nKD7y1fw
z{V|;%8{;uM6w^&sUGbP+D8^*yQAE;p#2~C5fodomnIGJKi0;*@MrwMsqOlSp_(Ge0
z8)(hY>B5`==qyUaY!|aqJ}&~|5J0m60HN6o)ncZo<PAmDO<!IE4c$B_>Qh=VpR-iO
z$-I`4@*-lm85DJCLdG7<$PcY?E1G(i5RI6fBH;gwWQg)L09O^}R8wPqlS7mv_<JDu
zBR0c$MS9DF)xrQ3XdlDX!f_q3jHieBT5?L8k&}~(k(`w?@Vw%BR+^XqxK84I>Q*XJ
zq!g(M601#+`Jy!)_WbA~ea<34y_nOAnY=81SkwT@$#Zbg1Mt=V2+0Do5k9%_`d?ex
zKD%=B%H6Kgv%{t1snr%?@!Z0hjkflM3%A&t$CobP-zOJt4A2~=pSsebo%<AYEA>kk
z7B6gcoGWqXN*(9Q;dASp{khMbyD{WSH1kDGS-B!X1vGz58${^jAq=0%V&WVP)4-(a
zgOF=b_K|7uYO`q;O`<mB!0(Psa5(J+6Wo0H!-{G6RuJ|(KrgiHLnG26ME1-C>tGsM
zA2SWTn^1mQ@2!{yg02t29}_{xh6FKz)e;3d(t^1*Owd7CVNH*sIu>C7ECM)|wnebe
zk=ld-(uyrQu|<G9jd>S3$ulTEiwTbjE@G+?v|q<z*f`0PC{}L`b~<>O6|jqg@)7uc
z7ho6eEpdtEp>jB}&e@;)T%r{2rQ%vu-c^9YWdK84y<8)?#h^r<hnr}C-T$p0+yFax
ze;EeM&vyWJLv*<eYuB-;Zp`InSg*@Q)LuVt0>7*dj`4g~z4H0Pn@VjL6&mdT9m$Ju
z(*(^Mg}WH$5CjRbAa!u9r`CzXWxt5aev$-z^xRw^J6+?ojg(GYT5U-`8LuteSK^Y(
zXUgH^I%j|GbIDS;kBVzmc~=1nm(RFTxkhq}L1`NxLl3{PpoeE{9o00zKJwZ;4X+I!
z&t3zWKn(`0xp(Ouw_4tDTf;l1zamVxA*j$hZofGH&gjv2oVS=!O28s#DH;4G@SoQC
zc>Gi?hoJ%aNovWJDi0dj@a;Y5dNv})KJuxW0lsvMo$p3>8a-=T;(FKH*^!uKM{=61
zi_i-A4vU@!`aoB5vWV1$XcNC=5Jva|`05AYZ9_g_yvDLTQ9dBdm$=@0U|GN?wm<i|
z-cp#S;#yVSRe-{KU|DSSa*gB`uX4Q`=zk9`>*es^I%j|GbAy)ujpABW-c^9YW!;s^
zHIiElO52#Ng12F|;PtVO{b{x?w>`%7e_6w)Z^!kAFSk{Q2H<;fEovQ4i0gORWb_j8
z*wGrtZ3Tv?c@Ibp#vx30H7d7Njd}D7twLMcZ|^GvcCoJza7N*rabH2@C}<xWg&n6;
zKjou9aYkR^qjkVK%KvOMiCVh?WQWYCqPGWQI(6WYxmfWKWZ96=9;{)xhbhZFOlgkb
zj%g0c4G&dw!y`JfE)M5mlOEfH`n0a8qP=}bMxiwVyZ$Fg_L$@iM{d5l&UMqzeXbkX
zU0b4=FKWulH4@eMGuM6VdAAj4R7q~}D%ahBVR)Q7gou5}`8HtKdVCDB-aFa|b^&$&
z!f@}XGBe5NBtwd4ifS$|kJUxu-9a!Jh8e0LF2Nmiasrc+m{^|g%aGdzO1iNOq8rOV
zPC*w|Hx5b;@1g74K*>hX1iWwb*k(<7rh$@lj=oPQ`O>Jg75$81896yqoP^jb^@Gu*
z^xZ+_(fTZbq-LiyLV4%Y@GS6aJCa|8U;e&B<m<2+Y|zl~$gN|4uIFuf6h^p9dbANd
zU_aN&X&Y0dCt<ZMv}!|kpvDdDn(K%{e1OoV{mQQSz3NZ<ow_&JoUsFbC7cdGAV>S<
zfeOF!t$`essKxym$kAa3a`=Q!p)2j9oQL*@6b4*9cBI1&tHCqrfHQZ}ot@0wdm)&)
z1MdaX>@Mam=v;3P_#&5&a_?g&5vy)1i!bW7=dM}k5e}xC?YUd4J9jP4z3|m>v2{Z4
z;qB&xr<|ble#VMzjR=Q?!|904NVV>Qk#a-io$J#`SJgkpsvLa1@C`uZ>#u>MI&yLT
zHD{~9m@B}-XhzEw^Kz8Nch}{saxz3A{)eGB^)?dbTWYRsHdz;dO$94}6QVYqa2<%y
zjCp8~4u<v2`*G9Z1SPaifPR;?34xTD9p5tmoLJ0ba<DbgZ>59t0ZRv2Ff1J=xc4#N
zS``L5fE{ApiCD80&q=yKh2W2a;Ikt=m>k3e|385o!sIX}7{g=wASzN;b7sVe$joS3
zUMs}fcEGfem#~MbAWb_IlaB6X8Zb(QftrxbleCI*bOS>*(nyVTyhb{yV~mu`;Mo}(
zy_Bfk<)2lIDTppLh*Vjd>JZqf!Fn14I7te6IuBp{6MKv1?LBnD_9}{Ll}r4E8@};c
zi5tF~Er*Y;bHn#0LHNA$H!9@m=L^)J*|kd6t%kC@Syw98NNzD?K=0n<=bg035~^#d
zf>R9=bW|lhruvu&BeYn^Sk&~35L%lRMKj<;8e1>0`IJawlN0oPf_P#0ZwPAx&J4Om
zl~>=4C^H3(7<na=C>l!M47#%E(I9YIpTl2`WK5a<oI<R4Wxtfst&)IfMFGPgxbtUI
zXH9NeQ&iI@oJqa;?j@76`s>jPa#oxm+6>jjXlRULHaV;?+bAqi1uU^ct!c3pJuT&A
zVus~w&<!oMqKFAb*IAJ%)+VAwI$N9yIgJ(g)~+ztWYO0?FiIPrBGXU>uQH>TAo+)v
zW!Zmvd@T2`2*a{JXI7a5Uoycjnb24M;L_~k?9%nc>$k|A+1s;suHU|X@7iil|Ehmr
zf!hd%KkK>K^VyM`M{Z^AOx~Wnquti-<yO0oEvHMv@2&=ayx{xF-?sGe;>YX$c-bFc
zmOuZ=s(%z(`dXLNMRncxLfQ8MwD28U@NOJ9xZqt1FNSZNEi)Y(42Su3rl-vG-1V+8
oM;`b%_6_zygkzJK^goC+u|p5qIJO5xNSfH5hiy&lh;_&R2EN$Epa1{>

literal 0
HcmV?d00001

diff --git a/tests/test_inject_hashed_filenames.py b/tests/test_inject_hashed_filenames.py
new file mode 100644
index 0000000..579f368
--- /dev/null
+++ b/tests/test_inject_hashed_filenames.py
@@ -0,0 +1,77 @@
+"""Tests for bin/inject-hashed-filenames.py rewrite() (#3).
+
+Pinned behaviour: the rewrite is tag-aware — only `<script src="…">` and
+`<link href="…">` attribute values are replaced. Inert occurrences of the
+old src in HTML comments, JSON literals, or unrelated attributes must be
+left alone (the previous `html.replace` was substring-blind).
+"""
+import importlib.util
+import os
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+SCRIPT = os.path.join(os.path.dirname(HERE), "bin", "inject-hashed-filenames.py")
+
+spec = importlib.util.spec_from_file_location("ihf", SCRIPT)
+ihf = importlib.util.module_from_spec(spec)
+sys.modules["ihf"] = ihf
+spec.loader.exec_module(ihf)
+
+
+def test_rewrites_script_src_double_quoted():
+    html = '<script src="/static/dist/app.js"></script>'
+    out, n = ihf.rewrite(html, "/static/dist/app.js", "/static/dist/app.abc123.js")
+    assert n == 1
+    assert out == '<script src="/static/dist/app.abc123.js"></script>'
+
+
+def test_rewrites_script_src_single_quoted():
+    html = "<script src='/static/dist/app.js'></script>"
+    out, n = ihf.rewrite(html, "/static/dist/app.js", "/static/dist/app.abc123.js")
+    assert n == 1
+    assert "/static/dist/app.abc123.js" in out
+
+
+def test_rewrites_link_href():
+    html = '<link rel="stylesheet" href="/static/dist/app.css">'
+    out, n = ihf.rewrite(html, "/static/dist/app.css", "/static/dist/app.abc123.css")
+    assert n == 1
+    assert '/static/dist/app.abc123.css' in out
+
+
+def test_does_not_rewrite_inside_html_comment():
+    html = '<!-- old script was at /static/dist/app.js --><script src="/other.js"></script>'
+    out, n = ihf.rewrite(html, "/static/dist/app.js", "/static/dist/app.abc123.js")
+    assert n == 0
+    assert "/static/dist/app.js" in out
+    assert "/static/dist/app.abc123.js" not in out
+
+
+def test_does_not_rewrite_inside_json_literal():
+    html = '<pre>{ "src": "/static/dist/app.js" }</pre>'
+    out, n = ihf.rewrite(html, "/static/dist/app.js", "/static/dist/app.abc123.js")
+    assert n == 0
+    assert out == html
+
+
+def test_does_not_rewrite_unrelated_attribute():
+    html = '<img data-bundle="/static/dist/app.js">'
+    out, n = ihf.rewrite(html, "/static/dist/app.js", "/static/dist/app.abc123.js")
+    assert n == 0
+    assert out == html
+
+
+def test_does_not_rewrite_anchor_href():
+    # Even though <a href="…"> is a `href` attribute, it isn't a <link>.
+    html = '<a href="/static/dist/app.js">debug link</a>'
+    out, n = ihf.rewrite(html, "/static/dist/app.js", "/static/dist/app.abc123.js")
+    assert n == 0
+    assert out == html
+
+
+def test_rewrites_with_extra_attributes_around_src():
+    html = '<script type="module" src="/static/dist/app.js" defer></script>'
+    out, n = ihf.rewrite(html, "/static/dist/app.js", "/static/dist/app.abc123.js")
+    assert n == 1
+    assert '/static/dist/app.abc123.js' in out
+    assert 'type="module"' in out and 'defer' in out