vyos-documentation.git/.github, branch rolling

chore: T8937: move conflict labeling+comment from eps1lon GHA to Mergify (#2103)

2026-06-13T04:05:27+00:00

Removes the eps1lon `check-open-prs-conflict.yml` caller (which ran `eps1lon/actions-label-merge-conflict` on push to base branches to label conflicting PRs + comment) and replaces it with Mergify: - Conflict LABEL (`conflicts`): already handled by the inherited central `Label conflicting pull requests` rule (predicate `conflict`, toggle). Mergify re-evaluates continuously, so the GHA's push-triggered re-scan is covered natively — no local rule needed for the label. - Conflict COMMENT: a local additive rule `Comment on conflicting pull requests` (distinct name → does not replace the inherited label rule) posts the contributor-facing "please resolve" notice once when a PR enters conflict (Mergify dedupes the comment per rule+message). The GHA's clean-side "conflicts resolved" comment is intentionally NOT replicated — Mergify has no "was-conflicting-now-clean" predicate, and keying on `-conflict` would match every non-conflicting PR. This is the final piece of the T8937 Mergify-GHA retirement (the central `check-pr-conflict.yml` reusable was preserved pending this consumer; it is deleted in a follow-up vyos/.github PR once this merges). Advances: T8937 🤖 Generated by [robots](https://vyos.io)

ci: T8966: remove orphaned docs T-ID override (strict rule retired centrally) (#2083)

2026-06-06T07:02:36+00:00

T8960: ai-validation — mint vyos-bot token via get-token@production

2026-06-03T00:32:24+00:00

Swap the cross-repo-checkout token from the dedicated vyos-docs-reviewer App (VYOS_APP_ID/_PRIVATE_KEY) to the shared vyos-bot App via the fleet get-token composite, scoped contents:read. Skip-check now gates on APP_CLIENT_ID + APP_PRIVATE_KEY + ANTHROPIC_API_KEY (org-level vyos-bot creds); reword the stale token comment. PR-comment posting still uses the default GITHUB_TOKEN. Byte-identical to the paired reference copy in VyOS-Networks/vyos-docs-opus-reviewer (scripts/ai-validation.yml). 🤖 Generated by [robots](https://vyos.io)

ci: T8943: sweep HIGH-producer pins to renamed branches (rollout 1c) (#2071)

2026-05-30T13:05:48+00:00

Rewrites uses: pins to the three HIGH-fanout producers (vyos/.github, vyos/vyos-cla-signatures, VyOS-Networks/vyos-reusable-workflows) from their old default branch to the new production compat branch staged in Task 1. No functional change; pin-ref rewrite only. Tracking: T8943

chore: T8937: retire Mergify-replaceable GHA caller workflows

2026-05-30T07:44:58+00:00

Replaces 5 caller workflows now superseded by central Mergify rules. See https://vyos.dev/T8937 for the design + spec + plan. Advances: T8937 🤖 Generated by [robots](https://vyos.io)

ci(ai-validation): allow Pass 2 review on external-contributor PRs

2026-05-29T09:15:36+00:00

The upstream `anthropics/claude-code-action` performs a write-permission check on `github.actor` before our skip logic runs. On `pull_request_target` the actor is the PR author; external contributors resolve to `read` and the action exits 1 with `Actor does not have write permissions to the repository`. Net effect: AI validation has been failing on every external-contributor PR (LiudmylaNad, teslazonda, scottlaird in the last 4 weeks) while succeeding on maintainer PRs. Failure reproduced on run 26541079685 (PR #2061). Fix: set `allowed_non_write_users: '*'` on the Pass 2 step. The action bypasses the actor check when this input is set and `github_token` is provided (already the case). The action also auto-scrubs Anthropic / cloud / GHA secrets from subprocess envs when this input is set. Safe in THIS workflow because the existing defense-in-depth bounds what Pass 2 can do with untrusted PR content: - `allowedTools` restricted to inline-comment + read-only surfaces - `github_token` is the PR-scoped default (not the broader VYOS_APP_ID) - prompt marks PR content as untrusted via `` - workspace-wipe removes `CLAUDE.md` / `.claude/` before Pass 2 - prepare bundles MD via `git show HEAD:` (blob, not `cp`) Full rationale inlined as a comment block above the new input. 🤖 Generated by [robots](https://vyos.io)

ci: remove PR mirror workflow

2026-05-28T23:10:58+00:00

The mirror caller has been disabled and the target mirror repo at VyOS-Networks/vyos-documentation has been removed. Drop the workflow file so the repo state reflects "this repo does not mirror" without relying on a dangling disabled workflow.

ci(mergify): upgrade configuration to current format

2026-05-15T11:56:32+00:00

ci(ai-validation): skip prepare on Mergify-authored PRs

2026-05-14T06:27:19+00:00

Lifts the existing Mergify-author short-circuit (today inside validate's `secrets-check` step) to a job-level `if:` on `prepare`, so the whole pipeline skips for backport/queue PRs. Why now: every Mergify backport whose merge ref shares no shallow ancestor with the (advanced) base branch fails the prepare step at git diff "$BASE...HEAD" --name-only ... fatal: FETCH_HEAD...HEAD: no merge base (because base is `git fetch --no-tags --depth=1` and the merge ref is `fetch-depth: 2`). Proximate symptom: run 25842928620 on PR #2042 (sagitta backport of #2023). AI Validation isn't a required check so the queue isn't blocked, but every Mergify backport is left with a red "prepare" check that adds noise to PR review. The validate-level skip in commit 0e8a2956 was correct for the "claude-code-action rejects bot-initiated runs" failure mode but fires too late — prepare has already run and crashed before validate's `if: needs.prepare.outputs.has_md_changes == 'true'` even evaluates. Implementation: single job-level `if:` on prepare. validate's `needs: [prepare]` cascades the skip naturally (skipped needs make the dependent's expression-based `if:` evaluate against empty outputs). The in-step author check in validate stays as defense-in-depth. 🤖 Generated by [robots](https://vyos.io)

Merge pull request #2023 from vyos/yuriy/doc-linter-cleanup-followups

2026-05-14T05:06:07+00:00

ci(doc-linter): fix 12 accumulated bugs flagged across PR #2014/#2019/#2020 reviews