vyos-documentation.git/.github, branch scutum

ci: T9208: bump AI-validation reviewer pin to v1.0.4 for scutum branch map (#2204)

2026-08-14T15:06:17+00:00

🤖 Generated by [robots](https://vyos.io)

T9208: enable scutum CI triggers in scutum branch workflows (#2200)

2026-08-14T12:59:10+00:00

The scutum branch inherited its `.github/workflows/` from circinus, so the one workflow with a branch filter — context7-refresh.yml — lists rolling/circinus/sagitta and never fires for a push to scutum, leaving the branch's Context7 variant stale. Add scutum to the push-trigger branch list, the workflow_dispatch choice options and the variant allow-list, matching the enumeration convention: every branch copy of this workflow carries the full train list, so the file stays byte-identical across branches and remains backport-safe. Every other workflow on this branch already fires on scutum — lint-doc, check-pr-conflicts, cla-check and ai-validation are unfiltered (pull_request / pull_request_target), and submodules.yml plus update-translations.yml are cron/dispatch-only (GitHub schedules cron from the default branch only). 🤖 Generated by [robots](https://vyos.io)

ci: bump REVIEWER_REF to reviewer-v1.0.3 (rolling branch-map fix) (#2182) (#2183)

2026-08-03T18:29:17+00:00

The reviewer-v1.0.2 tag ships a branches.json that maps docs branch 'rolling' to vyos-1x branch 'current'. The vyos-networks/vyos-1x mirror renamed 'current' to 'rolling', so the 'Checkout vyos-1x at mapped branch' step fails on every rolling-based PR (first observed run 30565684480, PR #2177). reviewer-v1.0.3 carries the corrected mapping (rolling -> rolling) plus CI/docs-only changes; no reviewer Python source changes between the two tags. 🤖 Generated by [robots](https://vyos.io) (cherry picked from commit 3263d8760117ab85bdfc6e13bbaf2d45db3c10a8) Co-authored-by: Yuriy Andamasov

T9096: retire @current reusable-workflow refs (circinus)

2026-07-16T14:22:17+00:00

The frozen 'current' compat alias on vyos/.github and vyos-cla-signatures is being retired. Retarget refs of surviving reusables to @production; drop callers of reusables that were retired from the central repo (replaced by Mergify central config / rulesets). 🤖 Generated by [robots](https://vyos.io)

ci: track Context7 variant by branch (circinus companion) (#2128)

2026-07-02T17:31:26+00:00

Companion to vyos-documentation#2127 (rolling). That PR switched the Context7 1.5/1.4 variants to branch-backed and moved context7-refresh to a push trigger, but a push-triggered workflow only fires from the copy present on the pushed branch. Land the same two workflow changes on circinus so pushes here self-refresh the branch variant: - context7-refresh.yml: workflow_run chain → push trigger on rolling/circinus/sagitta; refresh payload uses branch:"circinus". - Delete update-version-tags.yml (obsolete — no more git-tag indirection; branch variant tracks HEAD natively). No context7.json on this branch — Context7 reads config only from the default branch (rolling). Workflow-only change. 🤖 Generated by [robots](https://vyos.io)

ci: T8966: remove orphaned docs T-ID override (strict rule retired centrally) (#2084)

2026-06-06T07:02:45+00:00

T8960: ai-validation — mint vyos-bot token via get-token@production

2026-06-03T00:57:16+00:00

Swap the cross-repo-checkout token from the dedicated vyos-docs-reviewer App (VYOS_APP_ID/_PRIVATE_KEY) to the shared vyos-bot App via the fleet get-token composite, scoped contents:read. Skip-check now gates on APP_CLIENT_ID + APP_PRIVATE_KEY + ANTHROPIC_API_KEY (org-level vyos-bot creds); reword the stale token comment. PR-comment posting still uses the default GITHUB_TOKEN. Byte-identical to the paired reference copy in VyOS-Networks/vyos-docs-opus-reviewer (scripts/ai-validation.yml). 🤖 Generated by [robots](https://vyos.io) (cherry picked from commit 459109f13adf026d012c4e803f4a86a8f84e6ce3)

ci(ai-validation): allow Pass 2 review on external-contributor PRs

2026-05-29T09:20:41+00:00

The upstream `anthropics/claude-code-action` performs a write-permission check on `github.actor` before our skip logic runs. On `pull_request_target` the actor is the PR author; external contributors resolve to `read` and the action exits 1 with `Actor does not have write permissions to the repository`. Net effect: AI validation has been failing on every external-contributor PR (LiudmylaNad, teslazonda, scottlaird in the last 4 weeks) while succeeding on maintainer PRs. Failure reproduced on run 26541079685 (PR #2061). Fix: set `allowed_non_write_users: '*'` on the Pass 2 step. The action bypasses the actor check when this input is set and `github_token` is provided (already the case). The action also auto-scrubs Anthropic / cloud / GHA secrets from subprocess envs when this input is set. Safe in THIS workflow because the existing defense-in-depth bounds what Pass 2 can do with untrusted PR content: - `allowedTools` restricted to inline-comment + read-only surfaces - `github_token` is the PR-scoped default (not the broader VYOS_APP_ID) - prompt marks PR content as untrusted via `` - workspace-wipe removes `CLAUDE.md` / `.claude/` before Pass 2 - prepare bundles MD via `git show HEAD:` (blob, not `cp`) Full rationale inlined as a comment block above the new input. 🤖 Generated by [robots](https://vyos.io) (cherry picked from commit 1fa39bd7ac64898f7a21922bc0f195d115d3cdeb)

ci(ai-validation): skip prepare on Mergify-authored PRs

2026-05-14T06:45:06+00:00

Lifts the existing Mergify-author short-circuit (today inside validate's `secrets-check` step) to a job-level `if:` on `prepare`, so the whole pipeline skips for backport/queue PRs. Why now: every Mergify backport whose merge ref shares no shallow ancestor with the (advanced) base branch fails the prepare step at git diff "$BASE...HEAD" --name-only ... fatal: FETCH_HEAD...HEAD: no merge base (because base is `git fetch --no-tags --depth=1` and the merge ref is `fetch-depth: 2`). Proximate symptom: run 25842928620 on PR #2042 (sagitta backport of #2023). AI Validation isn't a required check so the queue isn't blocked, but every Mergify backport is left with a red "prepare" check that adds noise to PR review. The validate-level skip in commit 0e8a2956 was correct for the "claude-code-action rejects bot-initiated runs" failure mode but fires too late — prepare has already run and crashed before validate's `if: needs.prepare.outputs.has_md_changes == 'true'` even evaluates. Implementation: single job-level `if:` on prepare. validate's `needs: [prepare]` cascades the skip naturally (skipped needs make the dependent's expression-based `if:` evaluate against empty outputs). The in-step author check in validate stays as defense-in-depth. 🤖 Generated by [robots](https://vyos.io) (cherry picked from commit 7d94d6116be1a4776b7317cb5190a83dd065e571)

ci(lint-doc): pin all GitHub Actions to commit SHAs

2026-05-14T05:08:38+00:00

Each `uses:` line was pinned to a mutable version tag (`@v6`, `@v0.8.4`, …). Tags can be rewritten to point to malicious code — CVE-2025-30066 (reviewdog/action-setup) and the tj-actions/changed-files incident in 2025 are the canonical real-world examples. GitHub's hardening guide for Actions recommends pinning to full-length commit SHAs and keeping the tag as a trailing comment for human readability. Resolved each action's tag to its commit SHA via `gh api /repos//git/refs/tags/` and verified the SHA is a commit (not an annotated-tag object) via `gh api /repos//git/commits/`: - actions/checkout v6 -> de0fac2e4500dabe0009e67214ff5f5447ce83dd - bullfrogsec/bullfrog v0.8.4 -> 1831f79cce8ad602eef14d2163873f27081ebfb3 - trilom/file-changes-action v1.2.4 -> a6ca26c14274c33b15e6499323aac178af06ad4b - actions/setup-python v6 -> a309ff8b426b58ec0e2a45f0f869d46889d02405 This change covers `lint-doc.yml` only. A fleet-wide sweep across every workflow in `.github/workflows/` is a separate effort — worth doing because the drift / supply-chain risk is the same in every one. Tracked as a follow-up to this PR's review. Tracked as item 11 of the rolling-side cleanup backlog from PR #2014 / #2019 / #2020 reviews. 🤖 Generated by [robots](https://vyos.io) (cherry picked from commit e99182b911dbe9d3a3f02e000426f7075cadc608)