VyOS readthedocs (mirror of https://github.com/vyos/vyos-documentation.git) https://git.amelek.net/vyos/vyos-documentation.git/atom?h=feature%2FT9082-codeql-onboard 2026-07-14T12:17:51+00:00 2026-07-14T12:17:51+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-14T12:17:51+00:00 urn:sha1:e494cb756544066706912ff505134c719b72753f 🤖 Generated by [robots](https://vyos.io) 2026-07-12T13:45:54+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-12T13:45:54+00:00 urn:sha1:d5028041cb783f5c9f3279f38828dbacbb38081f Phase-0 CodeRabbit finding on the PR-trigger commit: github.head_ref is not unique across forks, so two PRs from different forks with the same branch name would share a concurrency group. Key on github.event.pull_request.number instead. 🤖 Generated by [robots](https://vyos.io) 2026-07-12T13:42:21+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-12T13:42:21+00:00 urn:sha1:01a7a7b939af3eba31e776dc07e0e7bee3c47874 apex-deploy.yml's test job only triggered on push to rolling, so no PR-level check ran the workers/ vitest suite — that's how the vitest 3.2/pool-workers 0.18.4 peer conflict landed on rolling undetected (two dependabot PRs merged clean since nothing exercised `npm ci` in workers/ pre-merge). Add a `pull_request` trigger scoped to `workers/**` so the test job runs pre-merge. Gate deploy-canary and deploy-production with `if: github.event_name != 'pull_request'` so PR runs test only — no canary/production deploys fire on a PR (deploy-production would also auto-skip via `needs: deploy-canary` once canary skips, but the explicit `if:` keeps intent visible). Concurrency group now branches per-event so PR runs queue/cancel independently of the rolling deploy group instead of colliding with it. Validated with actionlint + a YAML parse check. 🤖 Generated by [robots](https://vyos.io) 2026-07-10T16:57:21+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-10T16:57:21+00:00 urn:sha1:ac31ab70216716bcaebb4168074b9a790f4fda8a 🤖 Generated by [robots](https://vyos.io) 2026-07-10T16:45:50+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-10T16:45:50+00:00 urn:sha1:bd19892033a56782065b40a11adf7162a9dacb4a 🤖 Generated by [robots](https://vyos.io) 2026-07-10T15:21:14+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-10T15:21:01+00:00 urn:sha1:361c586a7bd16d1697b6038d4188716f801b9fd5 pdflatex hard-errors on the Devanagari etymology text in docs/introducing/history.md ("! LaTeX Error: Unicode character व (U+0935) not set up for use with LaTeX") and separately cannot embed several pre-existing .webp images (no BoundingBox) — both previously undiscovered because the Devanagari error always halted the build first. latexmk -f (force mode) + pdflatex -interaction=nonstopmode makes the build tolerate both classes of per-glyph/per-image failure and finish, matching how ReadTheDocs has always built this project's PDF (verified against the live docs.vyos.io PDF: same Devanagari glyphs blanked, same ~4 images embedded out of 2000+ pages). latexmk exits non-zero in force mode even on a fully-produced PDF, so the workflow step now verifies the artifact itself (exists, >2MB) instead of relying on the command's exit code. 🤖 Generated by [robots](https://vyos.io) 2026-07-10T14:14:13+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-10T14:14:13+00:00 urn:sha1:21689ef59b0eb34b1a29eda739dc10d33d25b44a * docs-infra: scaffold Cloudflare workers workspace (versions.json v2, matrix, toolchain) 🤖 Generated by [robots](https://vyos.io) * docs-infra: record full Phase-0 plan decision in workers/PLAN.md 🤖 Generated by [robots](https://vyos.io) * docs-infra: shared content worker — asset serving, cache classes, X-Docs-Build, canary no-store 🤖 Generated by [robots](https://vyos.io) * docs-infra: run worker script before assets; test fetch entrypoint 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex manifest loader + dispatch map + runtime binding guard (TDD) 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex redirects (aliases, PDF, trailing-slash) + special paths (TDD) 🤖 Generated by [robots](https://vyos.io) * docs-infra: PDF redirect honors pdf:null and preserves query 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex UA gate — allowlist-wins, log-only AI crawlers, empty block list at launch 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex router (pipeline §3.2), themed 404/503, /kb seam, env configs + congruence test 🤖 Generated by [robots](https://vyos.io) * docs-infra: add missing-User-Agent regression test for apex UA gate 🤖 Generated by [robots](https://vyos.io) * docs-infra: R2-streaming preview worker — MIME map, noindex, no-store (TDD) 🤖 Generated by [robots](https://vyos.io) * docs-infra: preview 404 no-store + fetch handler tests 🤖 Generated by [robots](https://vyos.io) * docs-infra: bootstrap script — binding-target workers must exist before apex deploys 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex run_worker_first, lockfile for npm ci, PDF Location from manifest 🤖 Generated by [robots](https://vyos.io) * docs-infra: derive html_baseurl from DOCS_VERSION_SLUG with RTD fallback (canonical gate prereq) 🤖 Generated by [robots](https://vyos.io) * docs-infra: version picker + status banner + language scaffold (vanilla JS, TDD pure core) 🤖 Generated by [robots](https://vyos.io) * docs-infra: picker preserves query+hash across switch; valid breadcrumb markup 🤖 Generated by [robots](https://vyos.io) * docs-infra: Pagefind search wrapper with runtime base-path + preview prefix handling (TDD) 🤖 Generated by [robots](https://vyos.io) * docs-infra: pagefind wrapper — asset-failure notice + UI stylesheet load 🤖 Generated by [robots](https://vyos.io) * docs-infra: gate Pagefind searchbox to CF builds (RTD keeps stock search until cutover) 🤖 Generated by [robots](https://vyos.io) * docs-infra: deploy sanity gates — limits, critical pages, count-delta, canonical (TDD) 🤖 Generated by [robots](https://vyos.io) * docs-infra: hermetic gate tests via fixture versions.json 🤖 Generated by [robots](https://vyos.io) * docs-infra: docs-build workflow — candidate/smoke/promote two-stage deploy + registry + rollback Two-stage CF Workers pipeline: build in pinned container, assemble artifact, sanity gates, deploy candidate, scoped pre-traffic smoke via canary apex, promote (rollback-id capture, hostname purge, registry upload), post-promote probe + auto-rollback. DOCS_CF_LIVE repo variable gates every docs.vyos.io production interaction pre-cutover. scripts/docs_gates/smoke.py adds one authorized check beyond the spec: the version's index.html probe asserts the #vyos-search mount div is present in the response body, guarding CI silently forgetting DOCS_VERSION_SLUG (which would otherwise ship stock RTD search without the Pagefind gate noticing). 🤖 Generated by [robots](https://vyos.io) * docs-infra: build docs image in-workflow with buildx cache (v4.1 — digest pin dropped) Plan v4.1 amendment: the ghcr.io digest-pinned image does not exist (workflow would hard-fail at the first docker step on every push). Replace the BUILD_IMAGE env placeholder with an in-workflow docker build from docker/Dockerfile via docker/setup-buildx-action@v3 + docker/build-push-action@v6 (context: docker/, load: true, tags: docs-build:local, GHA cache from/to). The checked-out commit is the pin; buildx GHA cache keeps repeat builds cheap. Sphinx-build step swaps to docs-build:local; inner script unchanged. 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex/preview deploy workflow — canary auto, production behind environment approval * docs-infra: apex-deploy concurrency guard (per-ref, cancel-in-progress) 🤖 Generated by [robots](https://vyos.io) * docs-infra: fork-safe PR preview pipeline — approval record, R2 prefixes, label consumption, cleanup * docs-infra: nightly preview sweep — pipefail + per-prefix failure isolation 🤖 Generated by [robots](https://vyos.io) * docs-infra: nightly canary QA — per-entry sweep + URL-parity corpus vs RTD 🤖 Generated by [robots](https://vyos.io) * docs-infra: parity sweep scoped to CF-built versions; transport-error resilience 🤖 Generated by [robots](https://vyos.io) * docs-infra: one-off bootstrap workflow (binding targets — runs once on this push) 🤖 Generated by [robots](https://vyos.io) * docs-infra: remove one-off bootstrap workflow (bootstrap complete) 🤖 Generated by [robots](https://vyos.io) * docs-infra: one-off canary apex + preview deploy (route targets for Task 3.6 step 2c) 🤖 Generated by [robots](https://vyos.io) * docs-infra: remove one-off canary deploy workflow (targets live) 🤖 Generated by [robots](https://vyos.io) * docs-infra: address Phase-0 CodeRabbit findings (canonical gate, error caching, registry pointer, validation) 🤖 Generated by [robots](https://vyos.io) * docs-infra: strengthen manifest tests (full dispatch iteration, mutation-free validate) 🤖 Generated by [robots](https://vyos.io) * docs-infra: address GitHub CodeRabbit review (pointer-after-probe, fail-closed sweeps, block-precedence UA gate, preview hardening) 🤖 Generated by [robots](https://vyos.io) * docs-infra: adversarial review fixes — error no-store, probe retry, PR-list membership, preview dotted-segment 🤖 Generated by [robots](https://vyos.io) * docs-infra: serve oversized legacy PDF from R2 via apex (spec §5 fallback) The 1.3 PDF (29.2 MiB) exceeds the 25 MiB static-asset cap and is absent from the legacy content Worker's build, so /_/downloads/en/1.3/pdf/ (and the picker's PDF link) 301'd into a dead-end 404 post-cutover. Add the R2 object fallback spec §5 already documented but never implemented: a DOCS_PDFS R2 bucket binding on the apex Worker, a manifest pdf_r2_key field (1.3 only), and a router step ahead of version dispatch that streams the object with its own cache class (canary/error still force no-store). 🤖 Generated by [robots](https://vyos.io) * docs-infra: PDF R2 fallback honors Range + If-None-Match, preserves ETag 🤖 Generated by [robots](https://vyos.io) 2026-07-02T16:58:16+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-02T16:58:16+00:00 urn:sha1:d22ad24b1cded33c62714b10d48f2abd0e35dce5 * ci: track Context7 LTS variants by branch instead of moved git tags Switch the Context7 1.5/1.4 variants from tag-backed to branch-backed: - context7.json: previousVersions entries `{tag:"1.5"}`/`{tag:"1.4"}` → `{branch:"circinus"}`/`{branch:"sagitta"}`. Context7 now indexes the LTS branch HEADs directly. - Delete update-version-tags.yml. Its sole purpose was force-moving the git tags 1.5/1.4 to circinus/sagitta HEAD so the tag-backed Context7 variants tracked the branches. With branch-backed variants Context7 tracks the HEAD natively, so the tag indirection — and its re-run "moves the tag backward" footgun — is gone. - context7-refresh.yml: trigger directly on push to rolling/circinus/ sagitta (docs/** + context7.json paths) instead of chaining off the deleted tag-mover via workflow_run; refresh payload uses `branch:"circinus"`/`branch:"sagitta"` for the non-default variants. Operator follow-up (post-merge): the circinus/sagitta branch variants must be registered in the Context7 dashboard (a refresh by branch 404s until Context7 crawls the new config), and the now-unused git tags 1.5/1.4 can be deleted. 🤖 Generated by [robots](https://vyos.io) * ci: harden jq repo interpolation in context7-refresh Adversarial review (agy): use the $GITHUB_REPOSITORY runner env var (mapped as REPO) instead of inlining ${{ github.repository }} into the jq command string, matching the safe env-mapping pattern already used for EVENT_NAME/REF_NAME. github.repository is validated and low-risk, but this structurally removes the interpolation-into-shell surface. 🤖 Generated by [robots](https://vyos.io) 2026-06-13T04:05:27+00:00 Yuriy Andamasov yuriy@vyos.io 2026-06-13T04:05:27+00:00 urn:sha1:03abd003d2f9456c450c5e0068efeaf130b89f33 Removes the eps1lon `check-open-prs-conflict.yml` caller (which ran `eps1lon/actions-label-merge-conflict` on push to base branches to label conflicting PRs + comment) and replaces it with Mergify: - Conflict LABEL (`conflicts`): already handled by the inherited central `Label conflicting pull requests` rule (predicate `conflict`, toggle). Mergify re-evaluates continuously, so the GHA's push-triggered re-scan is covered natively — no local rule needed for the label. - Conflict COMMENT: a local additive rule `Comment on conflicting pull requests` (distinct name → does not replace the inherited label rule) posts the contributor-facing "please resolve" notice once when a PR enters conflict (Mergify dedupes the comment per rule+message). The GHA's clean-side "conflicts resolved" comment is intentionally NOT replicated — Mergify has no "was-conflicting-now-clean" predicate, and keying on `-conflict` would match every non-conflicting PR. This is the final piece of the T8937 Mergify-GHA retirement (the central `check-pr-conflict.yml` reusable was preserved pending this consumer; it is deleted in a follow-up vyos/.github PR once this merges). Advances: T8937 🤖 Generated by [robots](https://vyos.io) 2026-06-06T07:02:36+00:00 Yuriy Andamasov yuriy@vyos.io 2026-06-06T07:02:36+00:00 urn:sha1:403bb21d9b6a0a0836fb6cb4bb2e4231ce2224e0