summaryrefslogtreecommitdiff
path: root/.github/workflows
AgeCommit message (Collapse)Author
2 daysdocs-infra: use PR number (not head ref) in apex-deploy concurrency groupYuriy Andamasov
Phase-0 CodeRabbit finding on the PR-trigger commit: github.head_ref is not unique across forks, so two PRs from different forks with the same branch name would share a concurrency group. Key on github.event.pull_request.number instead. πŸ€– Generated by [robots](https://vyos.io)
2 daysdocs-infra: run workers tests on PRs (gap let broken deps land)Yuriy Andamasov
apex-deploy.yml's test job only triggered on push to rolling, so no PR-level check ran the workers/ vitest suite β€” that's how the vitest 3.2/pool-workers 0.18.4 peer conflict landed on rolling undetected (two dependabot PRs merged clean since nothing exercised `npm ci` in workers/ pre-merge). Add a `pull_request` trigger scoped to `workers/**` so the test job runs pre-merge. Gate deploy-canary and deploy-production with `if: github.event_name != 'pull_request'` so PR runs test only β€” no canary/production deploys fire on a PR (deploy-production would also auto-skip via `needs: deploy-canary` once canary skips, but the explicit `if:` keeps intent visible). Concurrency group now branches per-event so PR runs queue/cancel independently of the rolling deploy group instead of colliding with it. Validated with actionlint + a YAML parse check. πŸ€– Generated by [robots](https://vyos.io)
4 daysdocs-infra: retry LaTeX only when PDF absent; constrained poppler installYuriy Andamasov
πŸ€– Generated by [robots](https://vyos.io)
4 daysdocs-infra: PDF artifact check β€” exact file, page-count floor, restored retryYuriy Andamasov
πŸ€– Generated by [robots](https://vyos.io)
4 daysdocs-infra: force latexmk through per-glyph/per-image LaTeX errors in PDF buildYuriy Andamasov
pdflatex hard-errors on the Devanagari etymology text in docs/introducing/history.md ("! LaTeX Error: Unicode character ΰ€΅ (U+0935) not set up for use with LaTeX") and separately cannot embed several pre-existing .webp images (no BoundingBox) β€” both previously undiscovered because the Devanagari error always halted the build first. latexmk -f (force mode) + pdflatex -interaction=nonstopmode makes the build tolerate both classes of per-glyph/per-image failure and finish, matching how ReadTheDocs has always built this project's PDF (verified against the live docs.vyos.io PDF: same Devanagari glyphs blanked, same ~4 images embedded out of 2000+ pages). latexmk exits non-zero in force mode even on a fully-produced PDF, so the workflow step now verifies the artifact itself (exists, >2MB) instead of relying on the command's exit code. πŸ€– Generated by [robots](https://vyos.io)
4 daysdocs: Cloudflare Workers hosting pipeline (apex, content workers, CI, ↡Yuriy Andamasov
previews) (#2140) * docs-infra: scaffold Cloudflare workers workspace (versions.json v2, matrix, toolchain) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: record full Phase-0 plan decision in workers/PLAN.md πŸ€– Generated by [robots](https://vyos.io) * docs-infra: shared content worker β€” asset serving, cache classes, X-Docs-Build, canary no-store πŸ€– Generated by [robots](https://vyos.io) * docs-infra: run worker script before assets; test fetch entrypoint πŸ€– Generated by [robots](https://vyos.io) * docs-infra: apex manifest loader + dispatch map + runtime binding guard (TDD) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: apex redirects (aliases, PDF, trailing-slash) + special paths (TDD) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: PDF redirect honors pdf:null and preserves query πŸ€– Generated by [robots](https://vyos.io) * docs-infra: apex UA gate β€” allowlist-wins, log-only AI crawlers, empty block list at launch πŸ€– Generated by [robots](https://vyos.io) * docs-infra: apex router (pipeline Β§3.2), themed 404/503, /kb seam, env configs + congruence test πŸ€– Generated by [robots](https://vyos.io) * docs-infra: add missing-User-Agent regression test for apex UA gate πŸ€– Generated by [robots](https://vyos.io) * docs-infra: R2-streaming preview worker β€” MIME map, noindex, no-store (TDD) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: preview 404 no-store + fetch handler tests πŸ€– Generated by [robots](https://vyos.io) * docs-infra: bootstrap script β€” binding-target workers must exist before apex deploys πŸ€– Generated by [robots](https://vyos.io) * docs-infra: apex run_worker_first, lockfile for npm ci, PDF Location from manifest πŸ€– Generated by [robots](https://vyos.io) * docs-infra: derive html_baseurl from DOCS_VERSION_SLUG with RTD fallback (canonical gate prereq) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: version picker + status banner + language scaffold (vanilla JS, TDD pure core) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: picker preserves query+hash across switch; valid breadcrumb markup πŸ€– Generated by [robots](https://vyos.io) * docs-infra: Pagefind search wrapper with runtime base-path + preview prefix handling (TDD) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: pagefind wrapper β€” asset-failure notice + UI stylesheet load πŸ€– Generated by [robots](https://vyos.io) * docs-infra: gate Pagefind searchbox to CF builds (RTD keeps stock search until cutover) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: deploy sanity gates β€” limits, critical pages, count-delta, canonical (TDD) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: hermetic gate tests via fixture versions.json πŸ€– Generated by [robots](https://vyos.io) * docs-infra: docs-build workflow β€” candidate/smoke/promote two-stage deploy + registry + rollback Two-stage CF Workers pipeline: build in pinned container, assemble artifact, sanity gates, deploy candidate, scoped pre-traffic smoke via canary apex, promote (rollback-id capture, hostname purge, registry upload), post-promote probe + auto-rollback. DOCS_CF_LIVE repo variable gates every docs.vyos.io production interaction pre-cutover. scripts/docs_gates/smoke.py adds one authorized check beyond the spec: the version's index.html probe asserts the #vyos-search mount div is present in the response body, guarding CI silently forgetting DOCS_VERSION_SLUG (which would otherwise ship stock RTD search without the Pagefind gate noticing). πŸ€– Generated by [robots](https://vyos.io) * docs-infra: build docs image in-workflow with buildx cache (v4.1 β€” digest pin dropped) Plan v4.1 amendment: the ghcr.io digest-pinned image does not exist (workflow would hard-fail at the first docker step on every push). Replace the BUILD_IMAGE env placeholder with an in-workflow docker build from docker/Dockerfile via docker/setup-buildx-action@v3 + docker/build-push-action@v6 (context: docker/, load: true, tags: docs-build:local, GHA cache from/to). The checked-out commit is the pin; buildx GHA cache keeps repeat builds cheap. Sphinx-build step swaps to docs-build:local; inner script unchanged. πŸ€– Generated by [robots](https://vyos.io) * docs-infra: apex/preview deploy workflow β€” canary auto, production behind environment approval * docs-infra: apex-deploy concurrency guard (per-ref, cancel-in-progress) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: fork-safe PR preview pipeline β€” approval record, R2 prefixes, label consumption, cleanup * docs-infra: nightly preview sweep β€” pipefail + per-prefix failure isolation πŸ€– Generated by [robots](https://vyos.io) * docs-infra: nightly canary QA β€” per-entry sweep + URL-parity corpus vs RTD πŸ€– Generated by [robots](https://vyos.io) * docs-infra: parity sweep scoped to CF-built versions; transport-error resilience πŸ€– Generated by [robots](https://vyos.io) * docs-infra: one-off bootstrap workflow (binding targets β€” runs once on this push) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: remove one-off bootstrap workflow (bootstrap complete) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: one-off canary apex + preview deploy (route targets for Task 3.6 step 2c) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: remove one-off canary deploy workflow (targets live) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: address Phase-0 CodeRabbit findings (canonical gate, error caching, registry pointer, validation) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: strengthen manifest tests (full dispatch iteration, mutation-free validate) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: address GitHub CodeRabbit review (pointer-after-probe, fail-closed sweeps, block-precedence UA gate, preview hardening) πŸ€– Generated by [robots](https://vyos.io) * docs-infra: adversarial review fixes β€” error no-store, probe retry, PR-list membership, preview dotted-segment πŸ€– Generated by [robots](https://vyos.io) * docs-infra: serve oversized legacy PDF from R2 via apex (spec Β§5 fallback) The 1.3 PDF (29.2 MiB) exceeds the 25 MiB static-asset cap and is absent from the legacy content Worker's build, so /_/downloads/en/1.3/pdf/ (and the picker's PDF link) 301'd into a dead-end 404 post-cutover. Add the R2 object fallback spec Β§5 already documented but never implemented: a DOCS_PDFS R2 bucket binding on the apex Worker, a manifest pdf_r2_key field (1.3 only), and a router step ahead of version dispatch that streams the object with its own cache class (canary/error still force no-store). πŸ€– Generated by [robots](https://vyos.io) * docs-infra: PDF R2 fallback honors Range + If-None-Match, preserves ETag πŸ€– Generated by [robots](https://vyos.io)
12 daysci: track Context7 LTS variants by branch instead of moved git tags (#2127)Yuriy Andamasov
* ci: track Context7 LTS variants by branch instead of moved git tags Switch the Context7 1.5/1.4 variants from tag-backed to branch-backed: - context7.json: previousVersions entries `{tag:"1.5"}`/`{tag:"1.4"}` β†’ `{branch:"circinus"}`/`{branch:"sagitta"}`. Context7 now indexes the LTS branch HEADs directly. - Delete update-version-tags.yml. Its sole purpose was force-moving the git tags 1.5/1.4 to circinus/sagitta HEAD so the tag-backed Context7 variants tracked the branches. With branch-backed variants Context7 tracks the HEAD natively, so the tag indirection β€” and its re-run "moves the tag backward" footgun β€” is gone. - context7-refresh.yml: trigger directly on push to rolling/circinus/ sagitta (docs/** + context7.json paths) instead of chaining off the deleted tag-mover via workflow_run; refresh payload uses `branch:"circinus"`/`branch:"sagitta"` for the non-default variants. Operator follow-up (post-merge): the circinus/sagitta branch variants must be registered in the Context7 dashboard (a refresh by branch 404s until Context7 crawls the new config), and the now-unused git tags 1.5/1.4 can be deleted. πŸ€– Generated by [robots](https://vyos.io) * ci: harden jq repo interpolation in context7-refresh Adversarial review (agy): use the $GITHUB_REPOSITORY runner env var (mapped as REPO) instead of inlining ${{ github.repository }} into the jq command string, matching the safe env-mapping pattern already used for EVENT_NAME/REF_NAME. github.repository is validated and low-risk, but this structurally removes the interpolation-into-shell surface. πŸ€– Generated by [robots](https://vyos.io)
2026-06-12chore: T8937: move conflict labeling+comment from eps1lon GHA to Mergify (#2103)Yuriy Andamasov
Removes the eps1lon `check-open-prs-conflict.yml` caller (which ran `eps1lon/actions-label-merge-conflict` on push to base branches to label conflicting PRs + comment) and replaces it with Mergify: - Conflict LABEL (`conflicts`): already handled by the inherited central `Label conflicting pull requests` rule (predicate `conflict`, toggle). Mergify re-evaluates continuously, so the GHA's push-triggered re-scan is covered natively β€” no local rule needed for the label. - Conflict COMMENT: a local additive rule `Comment on conflicting pull requests` (distinct name β†’ does not replace the inherited label rule) posts the contributor-facing "please resolve" notice once when a PR enters conflict (Mergify dedupes the comment per rule+message). The GHA's clean-side "conflicts resolved" comment is intentionally NOT replicated β€” Mergify has no "was-conflicting-now-clean" predicate, and keying on `-conflict` would match every non-conflicting PR. This is the final piece of the T8937 Mergify-GHA retirement (the central `check-pr-conflict.yml` reusable was preserved pending this consumer; it is deleted in a follow-up vyos/.github PR once this merges). Advances: T8937 πŸ€– Generated by [robots](https://vyos.io)
2026-06-03T8960: ai-validation β€” mint vyos-bot token via get-token@productionYuriy Andamasov
Swap the cross-repo-checkout token from the dedicated vyos-docs-reviewer App (VYOS_APP_ID/_PRIVATE_KEY) to the shared vyos-bot App via the fleet get-token composite, scoped contents:read. Skip-check now gates on APP_CLIENT_ID + APP_PRIVATE_KEY + ANTHROPIC_API_KEY (org-level vyos-bot creds); reword the stale token comment. PR-comment posting still uses the default GITHUB_TOKEN. Byte-identical to the paired reference copy in VyOS-Networks/vyos-docs-opus-reviewer (scripts/ai-validation.yml). πŸ€– Generated by [robots](https://vyos.io)
2026-05-30ci: T8943: sweep HIGH-producer pins to renamed branches (rollout 1c) (#2071)HEADcurrentYuriy Andamasov
Rewrites uses: pins to the three HIGH-fanout producers (vyos/.github, vyos/vyos-cla-signatures, VyOS-Networks/vyos-reusable-workflows) from their old default branch to the new production compat branch staged in Task 1. No functional change; pin-ref rewrite only. Tracking: T8943
2026-05-30chore: T8937: retire Mergify-replaceable GHA caller workflowsYuriy Andamasov
Replaces 5 caller workflows now superseded by central Mergify rules. See https://vyos.dev/T8937 for the design + spec + plan. Advances: T8937 πŸ€– Generated by [robots](https://vyos.io)
2026-05-29ci(ai-validation): allow Pass 2 review on external-contributor PRsYuriy Andamasov
The upstream `anthropics/claude-code-action` performs a write-permission check on `github.actor` before our skip logic runs. On `pull_request_target` the actor is the PR author; external contributors resolve to `read` and the action exits 1 with `Actor does not have write permissions to the repository`. Net effect: AI validation has been failing on every external-contributor PR (LiudmylaNad, teslazonda, scottlaird in the last 4 weeks) while succeeding on maintainer PRs. Failure reproduced on run 26541079685 (PR #2061). Fix: set `allowed_non_write_users: '*'` on the Pass 2 step. The action bypasses the actor check when this input is set and `github_token` is provided (already the case). The action also auto-scrubs Anthropic / cloud / GHA secrets from subprocess envs when this input is set. Safe in THIS workflow because the existing defense-in-depth bounds what Pass 2 can do with untrusted PR content: - `allowedTools` restricted to inline-comment + read-only surfaces - `github_token` is the PR-scoped default (not the broader VYOS_APP_ID) - prompt marks PR content as untrusted via `<UNTRUSTED-PR-CONTENT>` - workspace-wipe removes `CLAUDE.md` / `.claude/` before Pass 2 - prepare bundles MD via `git show HEAD:<path>` (blob, not `cp`) Full rationale inlined as a comment block above the new input. πŸ€– Generated by [robots](https://vyos.io)
2026-05-29ci: remove PR mirror workflowYuriy Andamasov
The mirror caller has been disabled and the target mirror repo at VyOS-Networks/vyos-documentation has been removed. Drop the workflow file so the repo state reflects "this repo does not mirror" without relying on a dangling disabled workflow.
2026-05-14ci(ai-validation): skip prepare on Mergify-authored PRsYuriy Andamasov
Lifts the existing Mergify-author short-circuit (today inside validate's `secrets-check` step) to a job-level `if:` on `prepare`, so the whole pipeline skips for backport/queue PRs. Why now: every Mergify backport whose merge ref shares no shallow ancestor with the (advanced) base branch fails the prepare step at git diff "$BASE...HEAD" --name-only ... fatal: FETCH_HEAD...HEAD: no merge base (because base is `git fetch --no-tags --depth=1` and the merge ref is `fetch-depth: 2`). Proximate symptom: run 25842928620 on PR #2042 (sagitta backport of #2023). AI Validation isn't a required check so the queue isn't blocked, but every Mergify backport is left with a red "prepare" check that adds noise to PR review. The validate-level skip in commit 0e8a2956 was correct for the "claude-code-action rejects bot-initiated runs" failure mode but fires too late β€” prepare has already run and crashed before validate's `if: needs.prepare.outputs.has_md_changes == 'true'` even evaluates. Implementation: single job-level `if:` on prepare. validate's `needs: [prepare]` cascades the skip naturally (skipped needs make the dependent's expression-based `if:` evaluate against empty outputs). The in-step author check in validate stays as defense-in-depth. πŸ€– Generated by [robots](https://vyos.io)
2026-05-14Merge pull request #2023 from vyos/yuriy/doc-linter-cleanup-followupsYuriy Andamasov
ci(doc-linter): fix 12 accumulated bugs flagged across PR #2014/#2019/#2020 reviews
2026-05-14ci(ai-validation): skip validation on Mergify-authored PRsYuriy Andamasov
The upstream anthropics/claude-code-action rejects bot-initiated workflow runs with: Workflow initiated by non-human actor: mergify (type: Bot). Add bot to allowed_bots list or use '*' to allow all bots. This leaves a failing required check on every Mergify backport PR (#2025 today is the proximate symptom β€” circinus backport of #2016 is blocked from auto-merging by this). Per org policy, Mergify-authored PRs skip the bot-review flow entirely: the underlying change was already reviewed on the source PR. Re-running validation on the backport would also post duplicate findings. Fix: extend the existing `secrets-check` step (kept the id for backwards compat with the cascade of `if: steps.secrets-check.outputs.skip != 'true'` gates) to also short-circuit when `github.event.pull_request.user.login` equals `mergify[bot]`. Add a `skip_reason` output so the notify-on-PR step can distinguish bot-skip (silent) from missing-secrets (post a notice comment). Implementation notes: - PR author is bound through env: PR_AUTHOR (same pattern as secret bindings) so the template-expansion happens before bash sees the value as an already-quoted env variable. - Uses `printf '...%s\n' "$PR_AUTHOR"` for the notice line so the shell β€” not the YAML template engine β€” interpolates the author into the workflow log output. - Renamed step name to "Decide whether to skip validation" to reflect the broader scope; step id stays `secrets-check`. πŸ€– Generated by [robots](https://vyos.io)
2026-05-14ci(lint-doc): pin all GitHub Actions to commit SHAsYuriy Andamasov
Each `uses:` line was pinned to a mutable version tag (`@v6`, `@v0.8.4`, …). Tags can be rewritten to point to malicious code β€” CVE-2025-30066 (reviewdog/action-setup) and the tj-actions/changed-files incident in 2025 are the canonical real-world examples. GitHub's hardening guide for Actions recommends pinning to full-length commit SHAs and keeping the tag as a trailing comment for human readability. Resolved each action's tag to its commit SHA via `gh api /repos/<repo>/git/refs/tags/<tag>` and verified the SHA is a commit (not an annotated-tag object) via `gh api /repos/<repo>/git/commits/<sha>`: - actions/checkout v6 -> de0fac2e4500dabe0009e67214ff5f5447ce83dd - bullfrogsec/bullfrog v0.8.4 -> 1831f79cce8ad602eef14d2163873f27081ebfb3 - trilom/file-changes-action v1.2.4 -> a6ca26c14274c33b15e6499323aac178af06ad4b - actions/setup-python v6 -> a309ff8b426b58ec0e2a45f0f869d46889d02405 This change covers `lint-doc.yml` only. A fleet-wide sweep across every workflow in `.github/workflows/` is a separate effort β€” worth doing because the drift / supply-chain risk is the same in every one. Tracked as a follow-up to this PR's review. Tracked as item 11 of the rolling-side cleanup backlog from PR #2014 / #2019 / #2020 reviews. πŸ€– Generated by [robots](https://vyos.io)
2026-05-14ci(doc-linter): lint added + renamed files, not only modifiedYuriy Andamasov
Previous workflow: env: FILES_MODIFIED: ${{ steps.file_changes.outputs.files_modified }} run: python scripts/doc-linter.py "$FILES_MODIFIED" `trilom/file-changes-action`'s `files_modified` output is modifications-only. A PR adding a new `.md`/`.rst` doc page passed `files_added`, never `files_modified`, so a brand-new page with long lines or real public IPs slipped past the linter entirely. Workflow: also pass `files_added` and `files_renamed` as separate positional args. Each output is a JSON array (action v1.2.4) and is passed via env to avoid shell-quoting issues. Linter: `main()` now accepts one OR multiple positional argv entries, each a JSON array of paths. Arrays are merged and deduplicated before linting. Single-arg invocations remain backward-compatible. Switched from `ast.literal_eval` to `json.loads` β€” the action's outputs are JSON, and `json.loads` is the right tool (and dodges literal_eval-via-`eval`-substring linter warnings). Test coverage: - Two JSON arrays merge -> single linter run on union. - Empty-string argv entry skipped (no `files_renamed` in many PRs). - Malformed JSON -> falls back to walking DOCS_ROOT. - No argv -> walks DOCS_ROOT. - Single-arg invocation -> backward-compat preserved. Tracked as item 7 of the rolling-side cleanup backlog from PR #2014 / #2019 / #2020 reviews. πŸ€– Generated by [robots](https://vyos.io)
2026-05-12ci(ai-validation): stop retargeting origin to fork URLYuriy Andamasov
The previous CR-driven fix (7a7a8002) re-pointed origin to the PR's HEAD fork on the assumption that claude-code-action calls `git fetch origin <head-branch>`. That assumption is wrong for fork PRs: the action detects a fork PR and fetches `pull/<n>/head` instead, and those refs only exist on the base repo. Retargeting origin to the fork therefore breaks the fork-PR fetch path with: PR #<n> is from a fork, fetching via refs/pull/<n>/head... fatal: couldn't find remote ref pull/<n>/head Observed on run 25689321499 (PR #1891 from natali-rs1985/vyos-documentation). Leave origin pointed at vyos/vyos-documentation (the base repo) β€” that's where actions/checkout left it after the merge-ref checkout, and where `pull/<n>/head` resolves. Replace the step with an explanatory comment. πŸ€– Generated by [robots](https://vyos.io)
2026-05-11T8463: Update GitHub actions to latest versions [vyos-documentation] (#1995)Andrii Klymenko
2026-05-11ci(ai-validation): pin validate to prepare merge_sha + fix 2 stray escapesYuriy Andamasov
CR/Copilot pass on the merge-ref + retarget-origin revision raised: 1. (CR on #1991, line 278, Major) Re-resolving refs/pull/<n>/merge in validate is racy. GitHub may advance the merge ref between prepare and validate (rapid pushes), so Pass 1 (artifact from prepare) and Pass 2 (validate workspace) can see different revisions. concurrency.cancel-in-progress narrows the window but does not make the ref immutable. Fix: prepare outputs its post-checkout `git rev-parse HEAD` as `merge_sha`, validate checks out THAT exact sha. Both jobs now operate on the same revision regardless of subsequent pushes. 2. (Copilot on #1991, two findings on line 294) The merge-ref + retarget commit introduced two NEW stray heredoc escapes: `PR"'sclaude-code-action'"s`. Same class of error as the previous-fix-cycle: shell heredoc escape sequences survived verbatim into YAML. Fix: replace with plain `PRs` / `claude-code-actions` in the inline comment block and step name. 3. (Copilot on #1990/#1991, "PR title/description says HEAD repo + head.sha") Metadata cleanup tracked separately β€” PR titles + bodies updated to describe the merge-ref + retarget-origin approach (no workflow file change for that part). Mirrored byte-identically across the 3 open wave-5 PRs (#1990 rolling, #1991 circinus, #1993 sagitta follow-up). Canonical sync once these merge.
2026-05-11ci(ai-validation): merge-ref checkout + retarget origin to fork + wipe ↡Yuriy Andamasov
CLAUDE.md/.claude (CR findings) Two new CR findings on PR #1990 (both raised on the same review cycle): 1. (CR, line 296, Major, Heavy lift) Tree drift between Pass 1 and Pass 2. The prior fix in this PR used `head.sha` (origin=fork) so the action's `git fetch origin <head-ref>` resolves β€” but that left validate's workspace tree at PR HEAD while prepare bundled `diff-md.patch` + `_changed_md/` from `refs/pull/<n>/merge`. For PRs where base also contributes content to a touched file, Pass 2 workspace-Read could disagree with Pass 1's view. Fix: switch the validate checkout back to `refs/pull/<n>/merge` (workspace tree now matches the prepare bundle) and address the action's `git fetch origin <head-ref>` requirement separately by `git remote set-url origin <fork-url>` after the checkout. The workspace tree is unchanged by the remote retarget; only the fetch destination is updated. For public forks (the only kind targeting public vyos/vyos-documentation) the unauthenticated fetch succeeds. 2. (CR, line 316, Major) `anthropics/claude-code-action@v1` invokes the Claude Code CLI, which auto-discovers and loads `CLAUDE.md` and `.claude/**` (memory, skills, hooks, MCP, plugins) from the workspace at session startup. A malicious fork could pre-place a `CLAUDE.md` with prompt-injection content, or a `.claude/skill.md` marked as auto-load. Documented at: - code.claude.com/docs/en/claude-directory.md - code.claude.com/docs/en/memory Fix: add `CLAUDE.md` and `.claude` to the wipe list so Claude's auto-discovery starts from a clean slate (workflow-controlled state only). `--bare` would also disable this but would lose the `mcp__github_inline_comment` MCP server the action provides, so wiping reserved paths is the better fit. Mirrored across rolling (#1990), circinus (#1991), and the sagitta follow-up (#1993). Canonical sync once these merge.
2026-05-11ci(ai-validation): address 3 follow-up CR/Copilot findings on ↡Yuriy Andamasov
validate-checkout step After the first fix bundle landed on the three wave-5 PRs, three more findings surfaced: 1. (CR on #1991, line 312) `rm -f` silently no-ops on directories. A fork could commit `changed-md.txt/`, `diff-md.patch/`, or `pass1-findings.json/` AS DIRECTORIES (not files), and the wipe step would skip them β€” the subsequent artifact-download writes into the real-file path would then collide with the fork-placed directory, producing unpredictable behaviour. Fix: use `rm -rf` for ALL reserved paths uniformly. The distinction was cosmetic at best; making it uniform closes the gap. 2. (Copilot on #1991, line 311) `.venv/` is also fork-attackable. `astral-sh/setup-uv` with `activate-environment: true` creates `${{ github.workspace }}/.venv` and prepends its `bin/` to PATH. If a fork pre-populates `.venv/bin/`, those binaries land in PATH for subsequent steps (Pass 1 runs `vyos-doc-review`, Pass 2 runs `claude-code-action` whose internals may shell out). Fix: add `.venv` to the wipe list. 3. (Copilot on #1992, line 298) The inline comment block contains a literal `PR's` β€” a stray shell heredoc escape sequence that survived the commit verbatim. Confusing in YAML. Fix: replace with plain `PRs`. Mirrored byte-identically across rolling/circinus/sagitta + canonical follow-up after this wave merges.
2026-05-11ci(ai-validation): address 4 Copilot findings on validate-checkout stepYuriy Andamasov
CR pass on #1990/#1991/#1992 raised 4 findings on the new validate- side actions/checkout step. All valid; folding into one bundle: 1. Fork PR head-ref not found in base repo (#1990, #1991, #1992 each raised this). The previous form checked out refs/pull/<n>/merge from origin (vyos/vyos-documentation), leaving origin pointed at the base repo. claude-code-action then runs `git fetch origin <head-ref>` where <head-ref> is e.g. `contributor/branch` β€” which does NOT exist in the base repo for fork PRs, so the fetch fails the same way "no .git" failed before. Fix: check out the PR HEAD repo (the fork for fork PRs) at the head sha. origin now resolves to the head repo where the head ref exists, so the action's fetch succeeds. github.token is the default GITHUB_TOKEN which can read public forks (the only kind of fork that can target vyos/vyos-documentation, since that repo is public). 2. Untrusted PR content at workspace root can pre-create reserved paths (#1991). The PRs tree at workspace root could in principle contain `.reference-db/extracted/...`, `pass1-findings.json`, `_changed_md/poisoned.md`, etc., which subsequent steps would treat as workflow-generated. The fail- closed gate only checks `[ ! -d .reference-db/extracted ]` so a PR-placed empty `.reference-db/extracted/` would bypass it. Fix: add a "Wipe reserved workspace paths" step right after the checkout that `rm -rf`s the workflow-owned paths (.reference-db, .vyos-1x, reviewer, reviewer-src, _changed_md) and `rm -f`s the workflow-owned files (pass1-findings.json, diff-md.patch, changed-*.txt) β€” every one of these is recreated by the trusted producer step immediately following. 3. Checkout runs unconditionally even on skip=true paths (#1991). The checkout only needs to run when validate will actually use it (skip != true β†’ Pass 2 runs). Fix: gate the checkout (and the wipe step) on `if: steps.secrets-check.outputs.skip != true`. Move them AFTER the secrets-check step in step order so the conditional is meaningful. 4. "NO credentials" wording misleading (#1992). actions/checkout uses the GITHUB_TOKEN to download the tree β€” it is not an unauthenticated fetch. `persist-credentials: false` only suppresses writing the token into the resulting .git/config. Fix: rename the step to "Checkout PR HEAD (no persisted credentials)" and update the inline comment block to be explicit that the token is used for the download but not persisted. Mirrored byte-identically across rolling/circinus/sagitta + canonical follow-up after this wave merges.
2026-05-11ci(ai-validation): checkout PR merge ref in validate (claude-code-action ↡Yuriy Andamasov
needs git workspace) Smoke verify on PR #1977 (run 25659408343 after github_token fix landed) reached Pass 2 with valid auth but failed at action setup: fatal: could not open `docs/quick-start.md` for reading: No such file or directory fatal: not a git repository (or any of the parent directories): .git Action failed with error: Command failed: git fetch origin --depth=20 yuriy/docs-smoke-test-quickstart The action expects to run inside a git checkout of the PR's repo so it can `git fetch <head-ref>` and read changed files from the working directory. Our split-job design checks out vyos-1x, reviewer-src, and the reviewer-config sparse-checkout into named subdirs but leaves the workspace root empty (we only have _changed_md/ via artifact download). Add `actions/checkout` of `refs/pull/<n>/merge` as the FIRST step in validate. Subsequent steps that create named subdirs (_changed_md/, .vyos-1x/, reviewer-src/, reviewer/, .reference-db/) coexist with the docs/scripts/.github content checked out here β€” no path collisions. Trust model unchanged: * persist-credentials: false (no token in fork-content .git/config) * No shell step executes fork code (no pip/npm/make against the workspace; Pass 1 runs the trusted reviewer CLI; Pass 2 only uses allowlisted Read/Glob/Grep/mcp__github_inline_comment + Bash restricted to `gh pr comment|diff|view`) * The prepare job continues to provide the canonical bundled changed-md set via the pr-input artifact; validate now ALSO has the full PR tree available for cross-reference reads Mirrored byte-identically across rolling/circinus/sagitta + canonical follow-up.
2026-05-11Merge pull request #1985 from ↡Yuriy Andamasov
vyos/yuriy/ai-validation-claude-action-github-token-rolling ci(ai-validation): pass github_token to claude-code-action (skip OIDC exchange)
2026-05-11ci(ai-validation): pass github_token to claude-code-action (skip OIDC exchange)Yuriy Andamasov
Second smoke verify on PR #1977 (run 25658927427) reached Pass 2 but failed with "Action failed with error: Invalid OIDC token". Diagnosis: The action (anthropics/claude-code-action@v1) mints an OIDC token with audience `claude-code-github-action` and POSTs it to `api.anthropic.com/api/github/github-app-token-exchange` to receive an Anthropic-managed GitHub App token for posting back to the PR. The endpoint validated our OIDC token and rejected it ("Invalid OIDC token") β€” this happens on repos where Anthropic-side OIDC federation hasn't been provisioned for the GitHub org. Bypass the exchange entirely by providing `github_token` to the action: `setupGitHubToken()` in src/github/token.ts checks `process.env.OVERRIDE_GITHUB_TOKEN` first and uses it directly if set, skipping OIDC. `${{ github.token }}` is auto-scoped to the current PR repo and gets the validate job's permissions (pull-requests: write, issues: write, contents: read) β€” exactly what the action needs. `steps.app.outputs.token` (our App token) is NOT suitable here: it's scoped to the VyOS-Networks org (vyos-1x, vyos-docs-opus-reviewer) for the earlier reviewer-source / vyos-1x checkouts, and has no write access on vyos/vyos-documentation PRs. Side effect: comments now post as github-actions[bot] (the workflow's own bot identity) rather than as claude[bot] (the Anthropic-managed GitHub App). Acceptable trade-off, and arguably preferable β€” the inline-review identity is now visibly the VyOS workflow rather than an external bot. Mirrored byte-identically across rolling/circinus/sagitta + canonical PR (folded into the still-open VyOS-Networks/vyos-docs-opus-reviewer#17).
2026-05-11ci(context7): gate version-tag move + refresh on docs-only changesYuriy Andamasov
Add `paths:` filter to `Update version tags` push trigger so infra-only pushes (workflows, scripts, Docker, README, etc.) skip the tag move and therefore skip the downstream Context7 refresh. Context7 only ingests `docs/**` (per context7.json `folders`), so refreshing on infra commits wasted API calls and gave no benefit. `context7.json` is also covered because changes to its `rules`/`folders`/`excludeFolders` affect what Context7 returns even when no .md files moved. The version tag's only consumer is Context7, so skipping the move on infra-only pushes is semantically correct β€” the tag still represents the latest docs state. `workflow_dispatch` on context7-refresh.yml remains available to force a refresh out of band. πŸ€– Generated by [robots](https://vyos.io)
2026-05-11ci(ai-validation): restore id-token: write (claude-code-action@v1 uses OIDC)Yuriy Andamasov
Revert of the id-token drop from #1969. Smoke verify on PR #1977 (empty-commit retrigger run 25658256103) failed at the Pass 2 step: Action failed with error: Could not fetch an OIDC token. Did you remember to add `id-token: write` to your workflow permissions? The earlier Copilot finding that motivated dropping the permission ("no step uses OIDC") was incomplete. No shell step in the workflow invokes OIDC directly, but anthropics/claude-code-action@v1 itself calls actions/core's `getIDToken()` internally β€” likely for the Claude/Anthropic auth federation path. The required scope is the third-party action's, not the workflow body's. Adding id-token: write back with an inline comment block citing the specific failure mode + the run ID where it was reproduced so this isn't re-dropped on a future review pass. Mirrored byte-identically across rolling/circinus/sagitta + canonical.
2026-05-11ci(ai-validation): add :(glob) pathspec magic so top-level docs/*.md matchYuriy Andamasov
CRITICAL BUG discovered during smoke verify of PR #1977 (a draft PR touching docs/quick-start.md). The prepare job ran SUCCESS but validate SKIPPED because has_md_changes was false: $ git diff origin/rolling...HEAD --name-only -- 'docs/**/*.md' (empty) $ git diff origin/rolling...HEAD --name-only -- ':(glob)docs/**/*.md' docs/quick-start.md Root cause: git's default pathspec syntax uses fnmatch with FNM_PATHNAME (slashes are not crossed by `*`). The `**` glob is NOT recognized in default pathspec β€” it's treated as plain `**` (two consecutive asterisks). For `docs/**/*.md` this means git requires at least one `/` between `docs/` and `*.md`, so: - docs/configuration/service/foo.md β†’ MATCHES (1+ subdir) - docs/quick-start.md β†’ NO MATCH (0 subdirs) - docs/index.md β†’ NO MATCH (0 subdirs) - docs/cli.md β†’ NO MATCH (0 subdirs) - docs/copyright.md β†’ NO MATCH (0 subdirs) - docs/coverage.md β†’ NO MATCH (0 subdirs) - docs/404.md β†’ NO MATCH (0 subdirs) - docs/documentation.md β†’ NO MATCH (0 subdirs) 7 top-level files silently bypass validation on every PR that touches them. Adding the `:(glob)` magic prefix opts in to true shell-style ** semantics (also recognised by git's pathspec parser per gitignore-pattern rules): - docs/**/*.md β†’ :(glob)docs/**/*.md - docs/**/*.rst β†’ :(glob)docs/**/*.rst Three pathspec usages updated in the prepare job; comment references to "docs/**/*.md" left unchanged (they read as informal shorthand). Paired PR on VyOS-Networks/vyos-docs-opus-reviewer adjusts the canonical scripts/ai-validation.yml identically.
2026-05-11ci(ai-validation): collapse split-backtick comment span (Copilot)Yuriy Andamasov
Copilot finding on #1974/#1975: the inline backtick code span `[ -s diff-md.patch ] && [ ! -d .reference-db/extracted ]` was split across two YAML comment lines, which renders poorly in Markdown viewers (the backtick crosses the line boundary). Reworded to put the relevant filesystem-presence check (`-d .reference-db/extracted`) on a single line and drop the redundant `-s diff-md.patch` half β€” the latter is the job-level gate condition, not part of the fail-closed gate logic, so omitting it from this rationale comment removes the wrap-required spread without losing meaning. The `-d` check on its own is what defines "the gate is a presence check, not a schema check". Mirrored byte-identically across rolling/circinus/sagitta.
2026-05-11ci(ai-validation): align fail-closed-gate comment + bump REVIEWER_REF to v1.0.2Yuriy Andamasov
Two small follow-ups now that the DB-pin revert wave (#1971/#1972/#1973 + canonical #15) has settled and `reviewer-v1.0.2` is tagged: 1. Comment alignment. The fail-closed-gate rationale comment that landed in #1971/#1972 says "the new code will refuse to load an older-format DB at the fail-closed gate". A Copilot finding on #1973 pointed out this is imprecise: the workflow's fail-closed gate is a presence check (`[ ! -d .reference-db/extracted ]`); it does not load or inspect the DB. The actual schema-mismatch protection lives inside the pinned reviewer Python code at `Pass 1 β€” deterministic checks` (loaded via `uv pip install ./reviewer-src` from `env.REVIEWER_REF`). The fix landed on sagitta (#1973 / b09ea673). This commit ports the same wording to this branch so the workflow file is byte-identical across rolling/circinus/sagitta again. 2. REVIEWER_REF bump v1.0.1 -> v1.0.2. The canonical at `VyOS-Networks/vyos-docs-opus-reviewer/scripts/ai-validation.yml` already defaults to v1.0.2 since the canonical-sync PR #15 merged and the `reviewer-v1.0.2` tag was pushed. v1.0.2 is functionally identical to v1.0.1 β€” the Python package and `branches.json` are unchanged; the bump just aligns this deployed copy with the canonical default for hygiene. No behavioral change.
2026-05-11ci(ai-validation): revert DB-download tag pin to latest:trueYuriy Andamasov
CRITICAL REGRESSION fix. PR #1969 changed the reference-DB download from `latest: true` to `tag: ${{ env.REVIEWER_REF }}` (set to `reviewer-v1.0.1`). Verification post-merge showed that: - The `reviewer-v1.0.1` tag exists but has **no GitHub release** attached: $ gh api /repos/VyOS-Networks/vyos-docs-opus-reviewer/releases/tags/reviewer-v1.0.1 {"message": "Not Found", "status": "404"} - Reference DBs are published to a separate release stream by the matrixed `rebuild-reference` workflow, tagged `ref-db-<UTC-timestamp>` (e.g. `ref-db-20260510-193946`). The reviewer Python package and the reference DBs have independent release cadences. `robinraju/release-downloader` with `tag: reviewer-v1.0.1` therefore 404s. The download step has `continue-on-error: true` so the run proceeds, but the fail-closed gate at "Fail if reference DB missing while MyST files are in the diff" then errors every validate run on a PR with MD changes. Our own recent test PRs (#1947 / #1956 / #1957 / #1968 / #1969 / #1970 on rolling, plus the circinus/sagitta backports) all happened to be infrastructure-only β€” `has_md_changes` was `false`, validate was skipped at the job level, and the DB step was never invoked. The regression was therefore invisible until the next real `.md`-changing PR would have failed red. Reverting to `latest: true` is the correct behavior. The reference DB schema is intentionally backwards-compatible across reviewer Python releases; the freshest DB is always usable. If the schema ever changes incompatibly, the way to opt out is bump `REVIEWER_REF` and the new reviewer code will refuse to load an older DB at the fail-closed gate β€” _exactly_ what we have today, just one level up. A paired PR on VyOS-Networks/vyos-docs-opus-reviewer/scripts/ ai-validation.yml ([#15](https://github.com/VyOS-Networks/vyos-docs-opus-reviewer/pull/15)) applies the same revert + bumps REVIEWER_REF default to v1.0.2 so canonical and deployed stay aligned after the next reviewer tag. A separate companion PR will backport this revert to circinus and sagitta to keep the workflow file byte-identical across all three release branches.
2026-05-11Merge pull request #1962 from vyos/yuriy/context7-tag-fieldYuriy Andamasov
ci: refresh Context7 LTS variants via tag field, not branch field
2026-05-11ci(ai-validation): 3 CR/Copilot follow-ups β€” NUL guard restore + issues: ↡Yuriy Andamasov
write + fail-closed gate CodeRabbit / Copilot findings on the merged PR #1959 and the still-open PRs #1960 + #1969: 1. NUL/control-char guard regressed. PR #1959 (merged into circinus without this) — and likewise sagitta/rolling-followup — had the guard inadvertently dropped during the rolling@HEAD rebase, because rolling@HEAD never had the corrected form. Restoring the user-corrected form: `LC_ALL=C grep -zPq "[\\x01-\\x1F\\x7F]"` reads the NUL-delimited *.z files directly (NUL is the record delimiter, not a forbidden byte) and rejects every other control byte 0x01-0x1F + 0x7F. An earlier `tr -d "\\0\\n\\r" | grep ...` form stripped the very bytes it was meant to reject before the grep ran — see the inline comment block for the contract. 2. `gh pr comment` requires `issues: write`. The skip-notice step and Pass 2 summary comment both post via `POST /repos/{owner}/{repo}/ issues/{number}/comments` — a PR conversation comment IS an issue comment in GitHub's data model. With only `pull-requests: write` the call can 403 on repos whose default GITHUB_TOKEN permission split routes issue-comment writes through `issues:`. Adding `issues: write` alongside the existing `pull-requests: write` keeps every comment path working without expanding the trust surface beyond what the original validate job needed. 3. Fail-closed gate used `[ -s changed-md.txt ]` (--diff-filter=ACMRT, excludes deletions) but validate is now gated on `has_md_changes` which is computed from `[ -s diff-md.patch ]` (unfiltered, deletion- aware). A deletion-only PR with a missing reference DB would reach validate (has_md_changes=true) but bypass the fail-closed gate (changed-md.txt empty), masking the DB-missing condition. Switch the gate to `[ -s diff-md.patch ]` so both signals agree. A separate Copilot finding (line 170, "validate gated on has_md_changes means RST-only PRs do not run") is pushed back on the PR thread as intentional design — RST is legacy per the RST→MyST migration, and the RST bookkeeping in prepare exists to surface mixed-MD-RST PRs in the Pass 2 prompt, not to drive validation on RST-only PRs.
2026-05-11ci: sanitize concurrency.group against arbitrary variant inputYuriy Andamasov
CodeRabbit review on #1962 flagged that concurrency.group is evaluated at workflow scheduling time, BEFORE the shell-level allowlist case in the job runs. An API-triggered workflow_dispatch with arbitrary variant value (e.g. 'gh workflow run -f variant=foobar') would produce concurrency key 'context7-refresh-foobar' and bypass dedupe with legitimate runs. Gate inputs.variant in the expression against the same allowlist ('rolling'/'1.5'/'1.4'). Map head_branch values to their canonical variant names so the workflow_run path also resolves cleanly. Fall through to 'invalid' if neither path matches β€” the shell allowlist then fails the run loud. πŸ€– Generated by [robots](https://vyos.io)
2026-05-11ci(ai-validation): fail-fast on traversal paths (consistency w/ non-regular ↡Yuriy Andamasov
guard) Copilot finding on PR #1959 (line 114): the path-traversal hardening block used `continue` (skip-with-warning) on detection of absolute / traversal paths, but the non-regular-tree-entry check below uses `exit 1`. The asymmetry meant a fork PR that smuggles in a path like `docs/../../outside.md` would silently bypass Pass 1 (no file copied into _changed_md/) and Pass 2 (LLM Read/Glob/Grep tools see no content) β€” reducing validation coverage on exactly the inputs that warrant the closest look. Change `continue` to `exit 1` so both unsafe-input checks have consistent visible-failure semantics. Maintainers must explicitly address an offending path rather than have it skipped. Mirrored byte-identically across all three open workflow PRs.
2026-05-11ci(ai-validation): rebase onto rolling@HEAD (#1968) β€” keep SHA pins/DB ↡Yuriy Andamasov
pin/no-id-token PR #1968 merged on rolling while this PR was in CR review. It adds: * has_md_changes output on prepare + job-level if-gate on validate (fixes the empty-_changed_md/ crash on infrastructure-only PRs) * fetch base by refs/heads/<ref> + use FETCH_HEAD instead of origin/<ref> (fixes the tag-vs-branch ambiguity on vyos/vyos- documentation where 'rolling' exists as both a branch and a tag) * skip validate on deletion-only Markdown PRs This commit pulls in rolling@HEAD's ai-validation.yml verbatim, then re-applies the 4 still-needed fixes raised by CR/Copilot: 1. SHA-pin actions/checkout@v6 (x4) + actions/upload-artifact@v4 + actions/download-artifact@v4 + anthropics/claude-code-action@v1 2. Pin reference-DB download to tag: ${{ env.REVIEWER_REF }} (was latest: true) β€” aligns DB version with pinned reviewer code 3. Drop id-token: write from validate job permissions (no OIDC use) Items already present in rolling@HEAD via PR #1968 (no further action here): * NUL/control-char rejection in changed-*.z (the corrected grep -zPq '[\x01-\x1F\x7F]' form, plus the explanatory comment block about why NUL is excluded from the rejection class) * Job-level if-gate on validate so infrastructure-only PRs skip the entire expensive validate chain * mkdir _changed_md defensive step in validate Result: 3 PRs (this one + the circinus/sagitta companions) now share a single byte-identical workflow file that is also a strict superset of rolling@HEAD's current file (3 fixes layered on top).
2026-05-11ci(ai-validation): reword NUL-guard comment for accuracyYuriy Andamasov
Two factual issues in prior wording (flagged by Copilot on #1969): - "NUL inside the name" implied embedded NUL is something to reject; NUL cannot appear in a git pathname (it is the tree-entry terminator). - "Filesystems … typically reject these" was wrong for LF/CR β€” POSIX filesystems allow them and git stores them fine. The actual hazard is in our line-delimited downstream tooling. Consolidated the two adjacent comment blocks into one accurate explanation. No behavior change. πŸ€– Generated by [robots](https://vyos.io)
2026-05-11ci(ai-validation): fix control-char guard β€” use grep -z, exclude NULYuriy Andamasov
Previous form `tr -d '\0\n\r' | grep -Pq [\x00-\x1F\x7F]` stripped the very chars (LF, CR) it was meant to catch before the grep ran, so a path containing newlines or carriage returns slipped through. `grep -z` keeps NUL as the record delimiter (legitimate separator from git diff -z) and the pattern excludes 0x00 while catching every other control byte 0x01-0x1F + 0x7F. LF/CR inside any path now correctly fail the guard. Surfaced by Copilot on #1969; applied to all three branch copies (rolling/circinus/sagitta) so the workflow stays in sync. πŸ€– Generated by [robots](https://vyos.io)
2026-05-11ci(ai-validation): scope GitHub App token to permission-contents: readYuriy Andamasov
The token is used only for read-only repo operations (sparse-checkout of reviewer branches.json, full checkout of vyos-1x, download of the reference-DB release asset). Without an explicit permission-* input the token inherits all installation permissions. Scope it down so a compromise cannot mutate either repo. Surfaced by CodeRabbit on #1960; applied to all three branch copies (rolling via #1969 follow-up + circinus #1959 + sagitta #1960) so the workflow stays in sync across the version-train branches. πŸ€– Generated by [robots](https://vyos.io)
2026-05-11ci(ai-validation): address 4 CR findings β€” SHA pins, NUL guard, DB pin, ↡Yuriy Andamasov
drop id-token Follow-up on the now-merged #1957 (ubuntu-latest switch). CodeRabbit raised these findings on the paired add-to-circinus PR #1959 (where the same file was being added to the circinus branch); since the file contents are byte-identical across rolling/circinus/sagitta, applying the same fixes here. 1. SHA-pin actions/checkout@v6 (x4), actions/upload-artifact@v4, actions/download-artifact@v4, anthropics/claude-code-action@v1. pull_request_target has secrets + repo write β€” GitHub security guidance recommends full commit SHAs as the only immutable release form. 2. Reject paths containing control characters (NUL/CR/LF) in changed-md.z and changed-rst.z before `tr '\0' '\n'` converts them to newline-delimited manifests. A fork PR committing `docs/foo<LF>bar.md` would otherwise split into two logical lines, masking the real file from line-based consumers. 3. Pin reference-DB download to `tag: ${{ env.REVIEWER_REF }}` (was `latest: true`). Aligns DB version with the pinned reviewer code; a future reviewer-v1.x.x release with a DB schema change can't be silently picked up. 4. Drop `id-token: write` from validate job permissions. No OIDC usage; copy-paste leftover. Paired PRs on release branches (byte-identical file contents): * circinus: #1959 (commit 025319ea) * sagitta: #1960 (commit e5506317)
2026-05-11ci: validate workflow_dispatch variant input against allowlistYuriy Andamasov
Copilot review on #1962 flagged that the type:choice UI constraint on workflow_dispatch.inputs.variant is bypassable when invoked via API (gh workflow run -f variant=…). An empty or arbitrary value would: - Generate a malformed concurrency key (context7-refresh- with empty suffix, since inputs.variant || head_branch || '' both go falsy) - Pass garbage to Context7's API (404s gracefully, but still a wasted runner minute and noisy) Add an explicit allowlist case after VARIANT is computed. Fails loud with a clear message before any downstream call. πŸ€– Generated by [robots](https://vyos.io)
2026-05-11Merge pull request #1958 from vyos/yuriy/fix-update-version-tags-raceYuriy Andamasov
ci: serialize update-version-tags runs to close back-to-back-push race
2026-05-11Merge pull request #1957 from vyos/yuriy/ai-validation-ubuntu-runnersYuriy Andamasov
ci(ai-validation): switch to GitHub-hosted ubuntu-latest runners
2026-05-11ci: address Context7 LTS variants via tag field, not branch fieldYuriy Andamasov
Post-#1961, the rolling auto-refresh (default variant, no field) succeeds, but workflow_dispatch for branch=circinus/sagitta still 404s. Further empirical curls against the live API revealed: POST /api/v1/refresh {"libraryName":"/vyos/vyos-documentation","branch":"circinus"} β†’ HTTP 404 {"error":"branch_not_found","message":"Branch 'circinus' not found"} POST /api/v1/refresh {"libraryName":"/vyos/vyos-documentation","tag":"1.5"} β†’ HTTP 200 {"message":"Refresh started successfully"} So Context7's API addresses variants by their REGISTRATION TYPE on the dashboard: - default variant (rolling) β†’ omit both 'branch' and 'tag' - tag-backed variants (1.5/1.4) β†’ 'tag' field - branch-backed non-default β†’ 'branch' field The dashboard shows 'rolling' with a branch icon and '1.5'/'1.4' with tag icons. The 'branch' field only addresses entries registered as branches; 'tag' addresses entries registered as tags. This is undocumented in the public GitHub Actions integration page but works against the live API. Changes: - Restore the variant mapping (circinus β†’ 1.5, sagitta β†’ 1.4) β€” that matches the actual dashboard variant names. #1961 had dropped this in favor of branch-name passthrough, which only worked for the default. - Switch the non-default payload from 'branch: <name>' to 'tag: <name>'. - workflow_dispatch input renamed back from 'branch' to 'variant'; choices back to [rolling, '1.5', '1.4']. - Restore the variant-keyed concurrency expression (with rewrite chain). - Update the documentation comment to record the empirical API semantics. Spec: ~/.claude/specs/2026-05-10-context7-github-actions-integration-design.md πŸ€– Generated by [robots](https://vyos.io)
2026-05-11ci: re-validate HEAD inside retag jobYuriy Andamasov
Both Copilot and CodeRabbit flagged the same hole on PR #1958: GitHub's "Re-run failed jobs" can execute retag in isolation, skipping check_head. If the branch HEAD advanced since the original run, the isolated retag would PATCH the tag to a stale github.sha. Add the same HEAD-equivalence guard inside retag, immediately before the PATCH/POST. Defense-in-depth β€” both jobs check, so neither full re-runs nor selective retag re-runs can move the tag backward. πŸ€– Generated by [robots](https://vyos.io)
2026-05-11ci(ai-validation): refresh two stale comments after ubuntu-latest switchYuriy Andamasov
Copilot review on the paired add-to-circinus PR (#1959) flagged two documentation drifts from the ubuntu-latest switch in this PR: 1. Line 65: comment referenced a 'cp loop' but the implementation has used 'git show HEAD:<path>' as the bundling mechanism since 1ea164ff. Reworded to describe the bundling loop accurately. 2. Line 270: comment explained why setup-uv was used 'on Debian 12' β€” stale now that the workflow runs on ubuntu-latest. Reworded to describe the actual reason setup-uv is preferred (fast interpreter provisioning + portable to self-hosted Debian if this workflow ever moves back). Documentation-only change. No behavioral effect.
2026-05-11ci: fix Context7 refresh β€” branch-name addressing + default-variant handlingYuriy Andamasov
The post-merge auto-fired runs from #1948/#1949/#1950 all returned 4xx errors. Diagnostic curls against the live Context7 API revealed two issues: 1. The 'branch' parameter addresses variants by their underlying Git branch name (rolling/circinus/sagitta), not by their tag display name (rolling/1.5/1.4). Sending 'branch: "1.5"' returns: HTTP 404 {"error":"branch_not_found","message":"Branch '1.5' not found"} 2. The default variant refreshes when the 'branch' field is omitted entirely. Sending 'branch: "rolling"' returns: HTTP 400 {"error":"branch-not-found","message":"Failed to refresh library"} But omitting the field returns: HTTP 200 {"message":"Refresh started successfully"} 3. (Bonus, validating #1951 was wrong direction.) The libraryName must include the leading slash: 'libraryName: "/vyos/vyos-documentation"' per Context7's docs. Without the slash returns: HTTP 404 {"error":"library_not_found"} This commit restores the leading slash that #1951 incorrectly removed. Changes: - Restore leading slash on libraryName ('/' + github.repository). - Drop the tag-name mapping in the case statement; pass head_branch directly as the branch value. - Omit the 'branch' field when head_branch is 'rolling' (default variant). - workflow_dispatch input renamed from 'version' to 'branch'; choice options changed from [rolling, '1.5', '1.4'] to [rolling, circinus, sagitta]. - Simplified concurrency expression (no longer needs the rewrite chain). - Documentation comment updated to explain the branch-name addressing. Spec: ~/.claude/specs/2026-05-10-context7-github-actions-integration-design.md This is the 'fallback mapping' path that the spec's variant table already documented as a contingency β€” pre-flight confirmed it's the correct path. πŸ€– Generated by [robots](https://vyos.io)
2026-05-10ci: keep stale reruns out of version-tag queuecopilot-swe-agent[bot]
Agent-Logs-Url: https://github.com/vyos/vyos-documentation/sessions/74be7b98-780e-4cbf-8177-11534c4ec2d7 Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-14 16:03:02 +0000