vyos-documentation.git, branch feature/T9082-codeql-onboard

ci: T9082: onboard CodeQL scanning via central reusable workflow

2026-07-14T12:17:51+00:00

🤖 Generated by [robots](https://vyos.io)

Merge pull request #2150 from vyos/claude/workers-vitest4

2026-07-13T07:48:43+00:00

docs: fix workers dependency conflict + test workers changes on PRs

docs-infra: use PR number (not head ref) in apex-deploy concurrency group

2026-07-12T13:45:54+00:00

Phase-0 CodeRabbit finding on the PR-trigger commit: github.head_ref is not unique across forks, so two PRs from different forks with the same branch name would share a concurrency group. Key on github.event.pull_request.number instead. 🤖 Generated by [robots](https://vyos.io)

docs-infra: run workers tests on PRs (gap let broken deps land)

2026-07-12T13:42:21+00:00

apex-deploy.yml's test job only triggered on push to rolling, so no PR-level check ran the workers/ vitest suite — that's how the vitest 3.2/pool-workers 0.18.4 peer conflict landed on rolling undetected (two dependabot PRs merged clean since nothing exercised `npm ci` in workers/ pre-merge). Add a `pull_request` trigger scoped to `workers/**` so the test job runs pre-merge. Gate deploy-canary and deploy-production with `if: github.event_name != 'pull_request'` so PR runs test only — no canary/production deploys fire on a PR (deploy-production would also auto-skip via `needs: deploy-canary` once canary skips, but the explicit `if:` keeps intent visible). Concurrency group now branches per-event so PR runs queue/cancel independently of the rolling deploy group instead of colliding with it. Validated with actionlint + a YAML parse check. 🤖 Generated by [robots](https://vyos.io)

docs-infra: align vitest with pool-workers 0.18 peer (dependabot ERESOLVE)

2026-07-12T13:42:11+00:00

Dependabot bumped @cloudflare/vitest-pool-workers to 0.18.4 (peer: vitest ^4.1.0) while workers/package.json still pinned vitest ~3.2.0, so npm ci ERESOLVEs in workers/ on rolling (docs-build run 29153221240; apex-deploy affected too). Bump vitest to ~4.1.0 to match the peer. 0.18.4 also removed the `@cloudflare/vitest-pool-workers/config` subpath export in favor of a `cloudflareTest()` Vite plugin — vitest.config.ts updated to the new shape (defineConfig from vitest/config + plugins: [cloudflareTest(...)]), matching the package's own vitest-v3-to-v4 codemod. No other files reference the old API. Verified: clean `npm ci` from a deleted node_modules resolves without --force/--legacy-peer-deps, `npm audit` reports 0 vulnerabilities (ws/wrangler bumps stay in place), and the full suite (`npx vitest run`) passes 84/84 across all 9 test files. 🤖 Generated by [robots](https://vyos.io)

chore(deps): bump ws and @cloudflare/vitest-pool-workers in /workers (#2141)

2026-07-11T12:47:18+00:00

Bumps [ws](https://github.com/websockets/ws) to 8.21.0 and updates ancestor dependency [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers). These dependencies need to be updated together. Updates `ws` from 8.18.0 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](https://github.com/websockets/ws/compare/8.18.0...8.21.0) Updates `@cloudflare/vitest-pool-workers` from 0.8.71 to 0.18.4 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.4/packages/vitest-pool-workers) --- updated-dependencies: - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.18.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): bump wrangler and @cloudflare/vitest-pool-workers (#2142)

2026-07-11T12:46:53+00:00

Bumps [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) to 4.110.0 and updates ancestor dependency [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers). These dependencies need to be updated together. Updates `wrangler` from 4.35.0 to 4.110.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.110.0/packages/wrangler) Updates `@cloudflare/vitest-pool-workers` from 0.8.71 to 0.18.4 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.4/packages/vitest-pool-workers) --- updated-dependencies: - dependency-name: wrangler dependency-version: 4.110.0 dependency-type: indirect - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.18.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Merge pull request #2145 from vyos/claude/pdf-image-conversion

2026-07-11T10:08:22+00:00

docs: render diagrams in PDF builds (imgconverter + ImageMagick/librsvg)

Merge rolling into claude/pdf-image-conversion (combine constrained apt line: imagemagick, librsvg2-bin, poppler-utils)

2026-07-11T07:34:18+00:00

🤖 Generated by [robots](https://vyos.io)

Merge pull request #2143 from vyos/claude/pdf-xelatex-fix

2026-07-11T07:30:03+00:00

docs: force latexmk through per-glyph/per-image errors (fix Devanagari PDF failure)