vyos-documentation.git, branch current

ci: T8943: sweep HIGH-producer pins to renamed branches (rollout 1c) (#2071)

2026-05-30T13:05:48+00:00

Rewrites uses: pins to the three HIGH-fanout producers (vyos/.github, vyos/vyos-cla-signatures, VyOS-Networks/vyos-reusable-workflows) from their old default branch to the new production compat branch staged in Task 1. No functional change; pin-ref rewrite only. Tracking: T8943

Merge pull request #2070 from vyos/chore/T8937-retire-mergify-replaceable-ghas

2026-05-30T07:54:00+00:00

chore: T8937: retire Mergify-replaceable GHA caller workflows

2026-05-30T07:44:58+00:00

Replaces 5 caller workflows now superseded by central Mergify rules. See https://vyos.dev/T8937 for the design + spec + plan. Advances: T8937 🤖 Generated by [robots](https://vyos.io)

Merge pull request #2063 from vyos/yuriy/aiv-allow-non-write-users

2026-05-29T09:20:20+00:00

ci(ai-validation): allow Pass 2 review on external-contributor PRs

2026-05-29T09:15:36+00:00

The upstream `anthropics/claude-code-action` performs a write-permission check on `github.actor` before our skip logic runs. On `pull_request_target` the actor is the PR author; external contributors resolve to `read` and the action exits 1 with `Actor does not have write permissions to the repository`. Net effect: AI validation has been failing on every external-contributor PR (LiudmylaNad, teslazonda, scottlaird in the last 4 weeks) while succeeding on maintainer PRs. Failure reproduced on run 26541079685 (PR #2061). Fix: set `allowed_non_write_users: '*'` on the Pass 2 step. The action bypasses the actor check when this input is set and `github_token` is provided (already the case). The action also auto-scrubs Anthropic / cloud / GHA secrets from subprocess envs when this input is set. Safe in THIS workflow because the existing defense-in-depth bounds what Pass 2 can do with untrusted PR content: - `allowedTools` restricted to inline-comment + read-only surfaces - `github_token` is the PR-scoped default (not the broader VYOS_APP_ID) - prompt marks PR content as untrusted via `` - workspace-wipe removes `CLAUDE.md` / `.claude/` before Pass 2 - prepare bundles MD via `git show HEAD:` (blob, not `cp`) Full rationale inlined as a comment block above the new input. 🤖 Generated by [robots](https://vyos.io)

Merge pull request #2062 from vyos/chore/remove-mirror-workflow

2026-05-28T23:25:15+00:00

ci: remove PR mirror workflow

2026-05-28T23:10:58+00:00

The mirror caller has been disabled and the target mirror repo at VyOS-Networks/vyos-documentation has been removed. Drop the workflow file so the repo state reflects "this repo does not mirror" without relying on a dangling disabled workflow.

docs: Update Static page to VyOS 1.5 standards (#2049)

2026-05-28T11:53:30+00:00

* docs: Update Static page to VyOS 1.5 standards * Update static.md * Remove needless words * Fix an incorrect fact about RIB not preserving routes after interface state changes --------- Co-authored-by: Daniil Baturin

ipsec: T7555: Documentation of `ikev2-reauth` option for site-to-site peers (#2047)

2026-05-28T10:39:28+00:00

docs: Update BFD page to VyOS 1.5 standards (#2056)

2026-05-26T10:27:08+00:00

* docs: Update BFD page to VyOS 1.5 standards * Update bfd.md * Remove mentions of security from the minimum-ttl section --------- Co-authored-by: Daniil Baturin