fix: render nonce on scripts and links to scripts

src/util.test.ts

@@ -6,12 +6,12 @@ beforeEach(() => {
     helpers = getRenderHelpers({nonce: 'random'});
 });
 
-test('should not render nonce for regular `<script>` tags', () => {
+test('should render nonce for regular `<script>` tags', () => {
     const script = helpers.renderScript({
         src: 'foo.js',
     });
 
-    expect(script).not.toEqual(expect.stringContaining('nonce="random"'));
+    expect(script).toEqual(expect.stringContaining('nonce="random"'));
 });
 
 test('should render `nonce` for inline `<script>` tags', () => {
@@ -26,8 +26,8 @@ test('should render `nonce` for inline styles', () => {
     expect(style).toEqual(expect.stringContaining('nonce="random"'));
 });
 
-test('should not render `nonce` for `<link>` tags', () => {
+test('should render `nonce` for `<link>` tags', () => {
     const link = helpers.renderLink({href: 'foo.js', as: 'script'});
 
-    expect(link).not.toEqual(expect.stringContaining('nonce="random"'));
+    expect(link).toEqual(expect.stringContaining('nonce="random"'));
 });

src/utils.ts

@@ -17,6 +17,7 @@ export function getRenderHelpers(params: {nonce?: string}): RenderHelpers {
                   defer,
                   async,
                   crossorigin: crossOrigin,
+                  nonce: params.nonce,
               })}></script>`
             : '';
     }
@@ -41,6 +42,7 @@ export function getRenderHelpers(params: {nonce?: string}): RenderHelpers {
                   href,
                   crossorigin: crossOrigin,
                   as,
+                  nonce: as === 'script' ? params.nonce : undefined,
                   ...rest,
               })}>`
             : '';