From 21cbb0f36db19a8321c17535438ed9a761c2b1e5 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Thu, 24 Sep 2026 10:28:42 -0400 Subject: [PATCH 01/39] Renovate: move config to JSONC, harden GitHub Actions bumps Same shape as docsy#2821, minus the audit test: JSONC keeps the comments that configMigration drops from JSON5; actions looked up as GitHub Releases, each bump its own SHA-named PR outside the patch and minor groups. CONTRIBUTING points at Docsy's maintainer notes for the family settings and keeps only this repo's own. --- CONTRIBUTING.md | 42 ++++++++++++++++++++---------------------- renovate.json5 | 33 --------------------------------- renovate.jsonc | 43 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 63 insertions(+), 55 deletions(-) delete mode 100644 renovate.json5 create mode 100644 renovate.jsonc diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 262bb39816..08f516da93 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -9,29 +9,26 @@ repo's [main ruleset][] mirrors Docsy's). ### Dependency updates -Renovate opens version-update PRs, created on Sundays, configured in -`renovate.json5`. Settings rationale: - -- `ignorePresets`: the preset's 3-day npm cooldown would override this repo's - 7-day `minimumReleaseAge`. Caution: this exclusion silently stops working if - the preset is renamed upstream. -- `lockFileMaintenance` off: wholesale lock re-resolves would churn the - committed lockfile; transitive security fixes arrive alert-driven instead. +Renovate opens version-update PRs, configured in `renovate.jsonc`. The family +settings and their rationale are Docsy's ([Dependency updates][]): the 7-day +minimum release age with the npm preset's shorter cooldown excluded, lock +maintenance off, the Sunday schedule, patch and minor grouping, and GitHub +Actions bumps as individual Release-dated PRs whose pin comments name a full +version, with the checks to run before merging one. This repo's own settings and +reasons: + +- `timezone`: the Sunday schedule reads in Montreal time. - `gomod` off: the Docsy theme pin is updated manually; see - [Upgrade Docsy](#upgrade-docsy). All other detected managers are active. -- Package rules: - - Patch and minor updates are each grouped into a single PR per wave, to cut - review overhead. Majors stay individual, except families that Renovate's - presets keep in lockstep (for example, the GitHub artifact actions). - - `hugo-extended` is version-pinned and coupled to its `allowScripts` approval - (see [Update Hugo](#update-hugo)). - - Bootstrap and Font Awesome updates route through the theme - (`packages/hugoautogen` is regenerated from the theme, reverting any direct - bump). A Dependabot security PR may still bump these directly: close it and - route the fix through a theme update. - -Renovate's vulnerability-alert PRs stay on (immediate, cooldown-exempt), beside -GitHub's Dependabot security updates; a rare duplicate PR is accepted. + [Upgrade Docsy](#upgrade-docsy). +- `hugo-extended` is version-pinned and coupled to its `allowScripts` approval + (see [Update Hugo](#update-hugo)). +- Bootstrap and Font Awesome updates route through the theme + (`packages/hugoautogen` is regenerated from the theme, reverting any direct + bump). A Dependabot security PR may still bump these directly: close it and + route the fix through a theme update. +- No audit test guards the action pin comments here: review does. An action + added to a workflow must publish GitHub Releases, or Renovate never proposes + its updates. ### Deploy logs @@ -94,6 +91,7 @@ watches it, so theme edits hot-reload. [alternate dashboard]: https://app.netlify.com/sites/goldydocs/deploys [contribution guidelines]: https://main--docsydocs.netlify.app/docs/contributing/ +[Dependency updates]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#dependency-updates [deploys]: https://app.netlify.com/sites/docsy-example/deploys [Docsy]: https://github.com/docsy/docsy [hugo-extended]: https://www.npmjs.com/package/hugo-extended diff --git a/renovate.json5 b/renovate.json5 deleted file mode 100644 index d5afef709c..0000000000 --- a/renovate.json5 +++ /dev/null @@ -1,33 +0,0 @@ -{ - $schema: 'https://docs.renovatebot.com/renovate-schema.json', - extends: ['config:best-practices'], - // For details about this repo's settings, see - // CONTRIBUTING.md#dependency-updates - ignorePresets: ['security:minimumReleaseAgeNpm'], - lockFileMaintenance: { enabled: false }, - timezone: 'America/Montreal', - schedule: ['* * * * 0'], // Sunday - labels: ['dependencies'], - gomod: { enabled: false }, - minimumReleaseAge: '7 days', - packageRules: [ - { - groupName: 'all patch versions', - matchUpdateTypes: ['patch'], - }, - { - groupName: 'all minor versions', - matchUpdateTypes: ['minor'], - }, - { - matchPackageNames: ['hugo-extended'], - enabled: false, // Manually updated to match Docsy requirements - }, - { - // Updates through Docsy. - matchPackageNames: ['bootstrap', '@fortawesome/fontawesome-free'], - enabled: false, - }, - ], - // cSpell:ignore gomod hugo fortawesome fontawesome -} diff --git a/renovate.jsonc b/renovate.jsonc new file mode 100644 index 0000000000..6d3fce3c20 --- /dev/null +++ b/renovate.jsonc @@ -0,0 +1,43 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["config:best-practices"], + // For details about this repo's settings, see + // CONTRIBUTING.md#dependency-updates + "ignorePresets": ["security:minimumReleaseAgeNpm"], + "lockFileMaintenance": { "enabled": false }, + "timezone": "America/Montreal", + "schedule": ["* * * * 0"], // Sunday + "labels": ["dependencies"], + "gomod": { "enabled": false }, + "minimumReleaseAge": "7 days", + "packageRules": [ + { + "groupName": "all patch versions", + "matchUpdateTypes": ["patch"], + "matchManagers": ["!github-actions"], + }, + { + "groupName": "all minor versions", + "matchUpdateTypes": ["minor"], + "matchManagers": ["!github-actions"], + }, + { + // Runner labels (runs-on) are github-actions deps too, with no Releases + // to look up. + "matchManagers": ["github-actions"], + "matchDepTypes": ["action", "workflow"], + "overrideDatasource": "github-releases", + "branchTopic": "{{{depNameSanitized}}}-{{{newDigest}}}", + }, + { + "matchPackageNames": ["hugo-extended"], + "enabled": false, // Manually updated to match Docsy requirements + }, + { + // Updates through Docsy. + "matchPackageNames": ["bootstrap", "@fortawesome/fontawesome-free"], + "enabled": false, + }, + ], + // cSpell:ignore gomod hugo fortawesome fontawesome +} From 98b758034608777b10b146d55235fc6e8eb245eb Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Thu, 24 Sep 2026 10:51:55 -0400 Subject: [PATCH 02/39] CONTRIBUTING: one pointer for the family settings; two local facts - Drops the inventory that followed the link and the Releases sentence: Docsy's notes own both (r1.1, r1.3) - Adds the local facts the old text implied: no min-release-age in .npmrc, so the notes' urgent-fix override does not apply here; review guards the pin comments (r1.2) --- CONTRIBUTING.md | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 08f516da93..98930ed4d0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -9,13 +9,10 @@ repo's [main ruleset][] mirrors Docsy's). ### Dependency updates -Renovate opens version-update PRs, configured in `renovate.jsonc`. The family -settings and their rationale are Docsy's ([Dependency updates][]): the 7-day -minimum release age with the npm preset's shorter cooldown excluded, lock -maintenance off, the Sunday schedule, patch and minor grouping, and GitHub -Actions bumps as individual Release-dated PRs whose pin comments name a full -version, with the checks to run before merging one. This repo's own settings and -reasons: +Renovate opens version-update PRs, configured in `renovate.jsonc`. For the +family settings and their rationale, the requirements on action pins, and the +checks before merging an action bump, see Docsy's [Dependency updates][]. This +repo's own settings and reasons: - `timezone`: the Sunday schedule reads in Montreal time. - `gomod` off: the Docsy theme pin is updated manually; see @@ -26,9 +23,9 @@ reasons: (`packages/hugoautogen` is regenerated from the theme, reverting any direct bump). A Dependabot security PR may still bump these directly: close it and route the fix through a theme update. -- No audit test guards the action pin comments here: review does. An action - added to a workflow must publish GitHub Releases, or Renovate never proposes - its updates. +- `.npmrc` sets no `min-release-age`: Renovate's cooldown is the only one here, + and the notes' override for an urgent npm fix does not apply. +- No audit test guards the action pin comments here: review does. ### Deploy logs From 1f669565c7b4f8076202d73906478850c82709c1 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Thu, 24 Sep 2026 11:40:15 -0400 Subject: [PATCH 03/39] CONTRIBUTING: drop the timezone bullet; the config is its home and it had no reason to add --- CONTRIBUTING.md | 1 - 1 file changed, 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 98930ed4d0..b9f8f019db 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -14,7 +14,6 @@ family settings and their rationale, the requirements on action pins, and the checks before merging an action bump, see Docsy's [Dependency updates][]. This repo's own settings and reasons: -- `timezone`: the Sunday schedule reads in Montreal time. - `gomod` off: the Docsy theme pin is updated manually; see [Upgrade Docsy](#upgrade-docsy). - `hugo-extended` is version-pinned and coupled to its `allowScripts` approval From e16ff4da6b5486637148e42a9b847671e66fc031 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Thu, 24 Sep 2026 12:01:18 -0400 Subject: [PATCH 04/39] CONTRIBUTING and config: the hugo rule's why lives in Update Hugo; two ambiguities resolved - Drops the hugo-extended config comment: it gave a reason the docs don't (r2 p1.1); the bullet now states the version-coupled approval, the reason Update Hugo owns (p2.1) - Names Docsy as the override's owner and the PR reviewer as the pin comments' check (p1.2, p2.2) --- CONTRIBUTING.md | 9 +++++---- renovate.jsonc | 2 +- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index b9f8f019db..0b15c49a7b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -16,15 +16,16 @@ repo's own settings and reasons: - `gomod` off: the Docsy theme pin is updated manually; see [Upgrade Docsy](#upgrade-docsy). -- `hugo-extended` is version-pinned and coupled to its `allowScripts` approval - (see [Update Hugo](#update-hugo)). +- `hugo-extended` updates stay off: its `allowScripts` approval is + version-coupled (see [Update Hugo](#update-hugo)). - Bootstrap and Font Awesome updates route through the theme (`packages/hugoautogen` is regenerated from the theme, reverting any direct bump). A Dependabot security PR may still bump these directly: close it and route the fix through a theme update. - `.npmrc` sets no `min-release-age`: Renovate's cooldown is the only one here, - and the notes' override for an urgent npm fix does not apply. -- No audit test guards the action pin comments here: review does. + and Docsy's urgent-fix override does not apply. +- No audit test guards the action pin comments here: the PR reviewer checks + them. ### Deploy logs diff --git a/renovate.jsonc b/renovate.jsonc index 6d3fce3c20..c4920b3279 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -31,7 +31,7 @@ }, { "matchPackageNames": ["hugo-extended"], - "enabled": false, // Manually updated to match Docsy requirements + "enabled": false, }, { // Updates through Docsy. From dac26369ca28d2f750e2ce1830cc1e5baf70f9b2 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Thu, 24 Sep 2026 12:06:25 -0400 Subject: [PATCH 05/39] CONTRIBUTING: the local list holds deltas only - Drops the hugo-extended bullet: docsy has the same rule and Docsy's notes and this file's Update Hugo already give the reason - Bootstrap/FA bullet reduced to what differs here: the regenerated manifest and the close-and-route step --- CONTRIBUTING.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0b15c49a7b..0091639a51 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -16,12 +16,10 @@ repo's own settings and reasons: - `gomod` off: the Docsy theme pin is updated manually; see [Upgrade Docsy](#upgrade-docsy). -- `hugo-extended` updates stay off: its `allowScripts` approval is - version-coupled (see [Update Hugo](#update-hugo)). -- Bootstrap and Font Awesome updates route through the theme - (`packages/hugoautogen` is regenerated from the theme, reverting any direct - bump). A Dependabot security PR may still bump these directly: close it and - route the fix through a theme update. +- Bootstrap and Font Awesome updates arrive through the theme: + `packages/hugoautogen` is regenerated from it, reverting any direct bump. A + Dependabot security PR that bumps them directly: close it and route the fix + through a theme update. - `.npmrc` sets no `min-release-age`: Renovate's cooldown is the only one here, and Docsy's urgent-fix override does not apply. - No audit test guards the action pin comments here: the PR reviewer checks From 8b48c716e81b690eb0d41f3f024a6b85fa466240 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Thu, 24 Sep 2026 12:25:12 -0400 Subject: [PATCH 06/39] CONTRIBUTING: drop the min-release-age bullet; the missing floor is a gap to close, not a setting to document --- CONTRIBUTING.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0091639a51..a41dbb6607 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -20,8 +20,6 @@ repo's own settings and reasons: `packages/hugoautogen` is regenerated from it, reverting any direct bump. A Dependabot security PR that bumps them directly: close it and route the fix through a theme update. -- `.npmrc` sets no `min-release-age`: Renovate's cooldown is the only one here, - and Docsy's urgent-fix override does not apply. - No audit test guards the action pin comments here: the PR reviewer checks them. From 1b98adf1fcbf2057405d0815f1e5fe9bff13ddc9 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 08:14:25 -0400 Subject: [PATCH 07/39] Bring .npmrc and .nvmrc back in step with docsy - Adds the npm release cooldown and the install-time script default-deny that docsy added in #2757/#2760, three days after #487 copied the older file; the registry pin stays docsy's (publisher-only) - Pins Node to docsy's version: lts/* floated in CI and was invisible to Renovate's nvm manager --- .npmrc | 12 +++++++++++- .nvmrc | 2 +- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.npmrc b/.npmrc index 0515324d11..671dd8d132 100644 --- a/.npmrc +++ b/.npmrc @@ -1,9 +1,19 @@ +# npm supply-chain controls; shared rationale (cross-repo one-home): +# https://opentelemetry.io/site/design/supply-chain-security/ +# Target: the docsy repo's .npmrc minus its @docsy:registry pin (publisher-only). + +min-release-age=7 +strict-allow-scripts=true # The npm engines floor (package.json) is the version where the allowScripts # policy landed; on older npm the key is silently ignored, an unprotected # install that looks protected. engine-strict turns that floor into a hard # install-time failure. engine-strict=true -strict-allow-scripts=true + +# Execution default-deny for every install (CI, Netlify, contributors). No +# call site re-enables scripts: the repo declares no lifecycle hooks and the +# hugo binary self-installs at first use. +ignore-scripts=true # One script interpreter on every platform: without this, Windows npm hands # scripts to cmd.exe, whose quoting rules silently diverge from sh (the diff --git a/.nvmrc b/.nvmrc index b009dfb9d9..b7179aed06 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -lts/* +24.20.0 From 5f837f430ad01eb90e9df979782149ae296a75a3 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 09:24:46 -0400 Subject: [PATCH 08/39] .npmrc: one comment per key, naming the decision it implements The linked page owns the rationale but names no npm keys; each comment now maps its key to the page's decision name and says nothing the page already does. The Windows shell note stays: a portability fact the page doesn't own. --- .npmrc | 26 ++++++++++---------------- 1 file changed, 10 insertions(+), 16 deletions(-) diff --git a/.npmrc b/.npmrc index 671dd8d132..81351a61eb 100644 --- a/.npmrc +++ b/.npmrc @@ -1,23 +1,17 @@ -# npm supply-chain controls; shared rationale (cross-repo one-home): +# npm supply-chain controls. Shared rationale: # https://opentelemetry.io/site/design/supply-chain-security/ -# Target: the docsy repo's .npmrc minus its @docsy:registry pin (publisher-only). +# Resolve only cooled-down releases. min-release-age=7 +# Run only reviewed lifecycle scripts (package.json allowScripts); unreviewed +# fails the install. strict-allow-scripts=true -# The npm engines floor (package.json) is the version where the allowScripts -# policy landed; on older npm the key is silently ignored, an unprotected -# install that looks protected. engine-strict turns that floor into a hard -# install-time failure. +# Fail closed on npm too old to enforce these settings (engines floor in +# package.json). engine-strict=true - -# Execution default-deny for every install (CI, Netlify, contributors). No -# call site re-enables scripts: the repo declares no lifecycle hooks and the -# hugo binary self-installs at first use. +# Default-deny install scripts; no call site here re-enables them (the hugo +# binary self-installs at first use). ignore-scripts=true - -# One script interpreter on every platform: without this, Windows npm hands -# scripts to cmd.exe, whose quoting rules silently diverge from sh (the -# single-quoted glob in test:site would no-match instead of erroring). Covers -# workspace runs too: npm resolves config at the workspace root. Git Bash -# ships with Git for Windows. +# One script interpreter on every platform: Windows npm defaults to cmd.exe, +# whose quoting silently diverges from sh. script-shell=bash From 3e563f9d9282aa459f8e66e3ec4b178237e8f846 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 09:29:58 -0400 Subject: [PATCH 09/39] .npmrc: comments pass; four per-key comments restated their keys Each key's name states its effect and the header's link owns the rationale; the Windows shell note stays, the one why the screen can't supply. --- .npmrc | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/.npmrc b/.npmrc index 81351a61eb..4cf864b128 100644 --- a/.npmrc +++ b/.npmrc @@ -1,17 +1,10 @@ # npm supply-chain controls. Shared rationale: # https://opentelemetry.io/site/design/supply-chain-security/ -# Resolve only cooled-down releases. min-release-age=7 -# Run only reviewed lifecycle scripts (package.json allowScripts); unreviewed -# fails the install. strict-allow-scripts=true -# Fail closed on npm too old to enforce these settings (engines floor in -# package.json). engine-strict=true -# Default-deny install scripts; no call site here re-enables them (the hugo -# binary self-installs at first use). ignore-scripts=true -# One script interpreter on every platform: Windows npm defaults to cmd.exe, -# whose quoting silently diverges from sh. + +# Windows npm defaults to cmd.exe, whose quoting silently diverges from sh. script-shell=bash From 4804a2b061ef650233a91deb8d96aca1eb39679a Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 10:17:37 -0400 Subject: [PATCH 10/39] CONTRIBUTING, netlify.toml: round-3 wording; the cooldown override in this repo's shape - Names the hugo-extended exclusion's reason (the pin follows Docsy's) and the npm cooldown's local override: update:hugo takes no version, so Docsy's recipe doesn't port (r3.2, r3.3) - netlify.toml's fallback comment names the control that acts, ignore-scripts (r3.4) - "family settings" was our jargon; install:safe is distinguished by lock-exactness only now; dashes constructs reworked (r3.5, r3.6, r3.9, r3.10) --- CONTRIBUTING.md | 24 ++++++++++++++---------- netlify.toml | 4 ++-- 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a41dbb6607..ed76151282 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -10,17 +10,17 @@ repo's [main ruleset][] mirrors Docsy's). ### Dependency updates Renovate opens version-update PRs, configured in `renovate.jsonc`. For the -family settings and their rationale, the requirements on action pins, and the -checks before merging an action bump, see Docsy's [Dependency updates][]. This -repo's own settings and reasons: +settings shared with Docsy and their rationale, the action-pin requirements, and +the merge checks, see Docsy's [Dependency updates][]. What differs here: - `gomod` off: the Docsy theme pin is updated manually; see [Upgrade Docsy](#upgrade-docsy). +- `hugo-extended` off: the pin follows Docsy's; see [Update Hugo](#update-hugo). - Bootstrap and Font Awesome updates arrive through the theme: - `packages/hugoautogen` is regenerated from it, reverting any direct bump. A - Dependabot security PR that bumps them directly: close it and route the fix - through a theme update. -- No audit test guards the action pin comments here: the PR reviewer checks + `packages/hugoautogen` is regenerated from it, reverting any direct bump. If a + Dependabot security PR bumps them directly, close it and route the fix through + a theme update. +- No audit test guards the action-pin comments here; the PR reviewer checks them. ### Deploy logs @@ -42,8 +42,7 @@ The Docsy-update scripts run it as their post phase, and CI reruns it to catch drift. If a theme update changes either file, commit the result. Installs themselves declare no lifecycle hooks (guarded by `tests/npm-scripts.test.mjs`), so neither install mode runs root-package code; `install:safe` remains the -lock-exact, script-free path, while a plain `npm install` resolves and may -rewrite the lock. +lock-exact path, while a plain `npm install` resolves and may rewrite the lock. ### Upgrade Docsy @@ -66,7 +65,12 @@ release, then run `npm run approve:hugo`: script-enabled installs fail until the new version is approved. The approval gates the install script only (the hugo binary self-installs at first use), so don't run builds between the two steps. Automated update PRs skip hugo-extended version bumps for the same reason, -except security updates, which fail CI until approved via `approve:hugo`. +except security updates, which fail CI until approved via `approve:hugo`. A +release under seven days old is held by the npm cooldown (`min-release-age`, +`.npmrc`); to take it anyway, run the install with a per-invocation override, +set no lower than the release's age requires, for example +`NPM_CONFIG_MIN_RELEASE_AGE=3 npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z` +(`update:hugo` takes no version argument). ### Develop against a local Docsy diff --git a/netlify.toml b/netlify.toml index 5513e02d1d..edbbb164a1 100644 --- a/netlify.toml +++ b/netlify.toml @@ -10,8 +10,8 @@ GO_VERSION = "1.22.2" # Constrain Netlify's automatic npm install to resolution only: no tree # writes, no scripts; _netlify:prepare runs the real, lock-exact install. If # NPM_FLAGS ever stops being honored, the auto-install runs for real: -# strict-allow-scripts (.npmrc) still gates its scripts, and the clean-tree -# bracket in _netlify:prepare flags its tree writes. The committed lockfile +# ignore-scripts (.npmrc) still skips its scripts, and the clean-tree bracket +# in _netlify:prepare flags its tree writes. The committed lockfile # and hugoautogen manifest cover the build's needs; the hugo binary # self-installs at first use. NPM_FLAGS = "--dry-run --ignore-scripts" From 95a9b9968154e36cff61e46774c059d181974cca Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 11:04:14 -0400 Subject: [PATCH 11/39] .npmrc: keep install scripts on; the allowScripts gate needs one path that runs them ignore-scripts=true would have made CI's npm ci script-free, so an unapproved hugo-extended bump would pass; docsy pays for the key with a targeted rebuild step this repo doesn't have. The strict allowlist on CI's install is the example's gate; netlify.toml's fallback comment is true again. --- .npmrc | 1 - netlify.toml | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.npmrc b/.npmrc index 4cf864b128..2999d6ec90 100644 --- a/.npmrc +++ b/.npmrc @@ -4,7 +4,6 @@ min-release-age=7 strict-allow-scripts=true engine-strict=true -ignore-scripts=true # Windows npm defaults to cmd.exe, whose quoting silently diverges from sh. script-shell=bash diff --git a/netlify.toml b/netlify.toml index edbbb164a1..5513e02d1d 100644 --- a/netlify.toml +++ b/netlify.toml @@ -10,8 +10,8 @@ GO_VERSION = "1.22.2" # Constrain Netlify's automatic npm install to resolution only: no tree # writes, no scripts; _netlify:prepare runs the real, lock-exact install. If # NPM_FLAGS ever stops being honored, the auto-install runs for real: -# ignore-scripts (.npmrc) still skips its scripts, and the clean-tree bracket -# in _netlify:prepare flags its tree writes. The committed lockfile +# strict-allow-scripts (.npmrc) still gates its scripts, and the clean-tree +# bracket in _netlify:prepare flags its tree writes. The committed lockfile # and hugoautogen manifest cover the build's needs; the hugo binary # self-installs at first use. NPM_FLAGS = "--dry-run --ignore-scripts" From 3ac467f781ff34079c7c633a9d0250c575863e6f Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 11:12:12 -0400 Subject: [PATCH 12/39] .npmrc: say why ignore-scripts is absent The next reader diffing this file against docsy's sees a gap and no reason; the comment is the reason, at the point of decision. --- .npmrc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.npmrc b/.npmrc index 2999d6ec90..f4473f7af4 100644 --- a/.npmrc +++ b/.npmrc @@ -4,6 +4,9 @@ min-release-age=7 strict-allow-scripts=true engine-strict=true +# No ignore-scripts here, unlike docsy: CI's install must run scripts for the +# allowScripts gate to fire; docsy re-enables them with a rebuild step this +# repo does not carry. # Windows npm defaults to cmd.exe, whose quoting silently diverges from sh. script-shell=bash From 04e98c9f63793ffccef1ed9f1f468e29805d4249 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 11:16:04 -0400 Subject: [PATCH 13/39] =?UTF-8?q?CONTRIBUTING=20=C2=A7=20Update=20Hugo:=20?= =?UTF-8?q?Docsy's=20flow=20by=20pointer,=20this=20repo's=20deltas;=20.npm?= =?UTF-8?q?rc=20points=20there?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The flow's shape and rationale were the same as Docsy's and restated; what differs (no version argument, no audit or rebuild step, the gate on CI's install) is now the section, and the ignore-scripts absence has its reason there rather than in the config. --- .npmrc | 4 +--- CONTRIBUTING.md | 30 ++++++++++++++++++------------ 2 files changed, 19 insertions(+), 15 deletions(-) diff --git a/.npmrc b/.npmrc index f4473f7af4..b0771b80d6 100644 --- a/.npmrc +++ b/.npmrc @@ -4,9 +4,7 @@ min-release-age=7 strict-allow-scripts=true engine-strict=true -# No ignore-scripts here, unlike docsy: CI's install must run scripts for the -# allowScripts gate to fire; docsy re-enables them with a rebuild step this -# repo does not carry. +# No ignore-scripts setting here: see CONTRIBUTING.md#update-hugo. # Windows npm defaults to cmd.exe, whose quoting silently diverges from sh. script-shell=bash diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ed76151282..c0015838f9 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -60,17 +60,23 @@ npm run update:docsy:main ### Update Hugo -To update Hugo, run `npm run update:hugo`, review the new [hugo-extended][] -release, then run `npm run approve:hugo`: script-enabled installs fail until the -new version is approved. The approval gates the install script only (the hugo -binary self-installs at first use), so don't run builds between the two steps. -Automated update PRs skip hugo-extended version bumps for the same reason, -except security updates, which fail CI until approved via `approve:hugo`. A -release under seven days old is held by the npm cooldown (`min-release-age`, -`.npmrc`); to take it anyway, run the install with a per-invocation override, -set no lower than the release's age requires, for example -`NPM_CONFIG_MIN_RELEASE_AGE=3 npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z` -(`update:hugo` takes no version argument). +The two-step flow and its rationale are Docsy's ([Officially supported Hugo +version][]): bump the pin script-free, review the release, then approve the new +version's install script. What differs here: + +- `npm run update:hugo` takes no version: it installs the newest `hugo-extended` + release that has passed the npm cooldown (`min-release-age`, `.npmrc`). For a + younger release, run the install under a per-invocation override set no lower + than the release's age requires, for example + `NPM_CONFIG_MIN_RELEASE_AGE=3 npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`. +- `npm run approve:hugo` approves the version and regenerates the theme + manifest; there is no supply-chain audit to re-run and no rebuild step: the + hugo binary self-installs at first use. +- The approval gate fires on CI's `npm ci`, the one install here that runs + scripts. That is why `.npmrc` does not set `ignore-scripts`, unlike Docsy's, + which re-enables scripts for hugo-extended alone in a rebuild step this repo + does not carry. An unapproved bump, a Dependabot security PR included, fails + CI until `approve:hugo` is run. ### Develop against a local Docsy @@ -91,10 +97,10 @@ watches it, so theme edits hot-reload. [Dependency updates]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#dependency-updates [deploys]: https://app.netlify.com/sites/docsy-example/deploys [Docsy]: https://github.com/docsy/docsy -[hugo-extended]: https://www.npmjs.com/package/hugo-extended [Hugo workspace]: https://gohugo.io/configuration/module/#top-level-settings [main ruleset]: https://github.com/docsy/docsy-example/rules/23697395 [Merge requirements]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#merge-requirements +[Officially supported Hugo version]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#official-hugo-version [workflow security analysis]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#workflow-security-analysis From a1967809a9de561d254197aab81e318361b473c5 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 11:41:25 -0400 Subject: [PATCH 14/39] CONTRIBUTING: the Hugo exclusion is Docsy's rule, not a delta; Update Hugo down to its three differences Docsy's notes own the exclusion, the self-installing binary, the rebuild step and the CI-fails-until-approved consequence; what stayed is what only this repo can say. --- CONTRIBUTING.md | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c0015838f9..36117d4a9f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -15,7 +15,6 @@ the merge checks, see Docsy's [Dependency updates][]. What differs here: - `gomod` off: the Docsy theme pin is updated manually; see [Upgrade Docsy](#upgrade-docsy). -- `hugo-extended` off: the pin follows Docsy's; see [Update Hugo](#update-hugo). - Bootstrap and Font Awesome updates arrive through the theme: `packages/hugoautogen` is regenerated from it, reverting any direct bump. If a Dependabot security PR bumps them directly, close it and route the fix through @@ -60,23 +59,16 @@ npm run update:docsy:main ### Update Hugo -The two-step flow and its rationale are Docsy's ([Officially supported Hugo -version][]): bump the pin script-free, review the release, then approve the new -version's install script. What differs here: +The flow is Docsy's ([Officially supported Hugo version][]). What differs here: -- `npm run update:hugo` takes no version: it installs the newest `hugo-extended` - release that has passed the npm cooldown (`min-release-age`, `.npmrc`). For a - younger release, run the install under a per-invocation override set no lower - than the release's age requires, for example - `NPM_CONFIG_MIN_RELEASE_AGE=3 npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`. +- `npm run update:hugo` takes no version: it installs the newest release the npm + cooldown admits. Docsy's cooldown override applies, with + `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z` in + place of `update:hugo -- X.Y.Z`. - `npm run approve:hugo` approves the version and regenerates the theme - manifest; there is no supply-chain audit to re-run and no rebuild step: the - hugo binary self-installs at first use. + manifest; there is no audit to re-run and no rebuild step. - The approval gate fires on CI's `npm ci`, the one install here that runs - scripts. That is why `.npmrc` does not set `ignore-scripts`, unlike Docsy's, - which re-enables scripts for hugo-extended alone in a rebuild step this repo - does not carry. An unapproved bump, a Dependabot security PR included, fails - CI until `approve:hugo` is run. + scripts; so `.npmrc` sets no `ignore-scripts`, unlike Docsy's. ### Develop against a local Docsy From 70017bce8571f7f88e861809bbaf34dee439b326 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 11:53:26 -0400 Subject: [PATCH 15/39] Drop update:hugo; the bump is the pinned install command The script defaulted to @latest, the opposite of Docsy's reviewed-exact-version step; the maintainer's bump is intentional and pinned, so the command with X.Y.Z is the step, and the doc names it without quoting Docsy's own command. --- CONTRIBUTING.md | 7 +++---- package.json | 1 - 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 36117d4a9f..2404b3c59b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -61,10 +61,9 @@ npm run update:docsy:main The flow is Docsy's ([Officially supported Hugo version][]). What differs here: -- `npm run update:hugo` takes no version: it installs the newest release the npm - cooldown admits. Docsy's cooldown override applies, with - `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z` in - place of `update:hugo -- X.Y.Z`. +- The bump is the plain command, + `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; + there is no `update:hugo` script. - `npm run approve:hugo` approves the version and regenerates the theme manifest; there is no audit to re-run and no rebuild step. - The approval gate fires on CI's `npm ci`, the one install here that runs diff --git a/package.json b/package.json index 001ad6854d..879d98d8a4 100644 --- a/package.json +++ b/package.json @@ -49,7 +49,6 @@ "update:docsy:main": "hugo mod get -u github.com/google/docsy/theme@main && npm run _update:docsy:post", "update:docsy:mod": "hugo mod get -u github.com/google/docsy/theme && npm run _update:docsy:post", "update:docsy:pack": "hugo mod npm pack && npm pkg set 'name=\"@docsy/hugoautogen\"' private=true --json --prefix packages/hugoautogen && npm install --ignore-scripts", - "update:hugo": "npm install --save-dev --save-exact --ignore-scripts hugo-extended@latest", "update:main": "npm run update:packages && npm run update:docsy:main", "update:packages": "npm-check-updates -u -x hugo-extended", "update": "npm run update:packages && npm run update:docsy:mod" From 64ee9143dacbf58be1fe3b1d0f9deb2892512852 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 12:11:24 -0400 Subject: [PATCH 16/39] update:hugo: newest aged release by default, --hugo=X.Y.Z to name one npm exports unknown run flags as npm_config_*; the flag name avoids npm's own option namespace (--v is npm's version flag). Bash-only expansion, true on every platform through the committed script-shell. The reviewed-version discipline stays where it is enforced: approve:hugo. --- CONTRIBUTING.md | 5 ++--- package.json | 1 + 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2404b3c59b..e7bf156cde 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -61,9 +61,8 @@ npm run update:docsy:main The flow is Docsy's ([Officially supported Hugo version][]). What differs here: -- The bump is the plain command, - `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; - there is no `update:hugo` script. +- `npm run update:hugo` pins the newest release the npm cooldown admits; + `--hugo=X.Y.Z` names one. - `npm run approve:hugo` approves the version and regenerates the theme manifest; there is no audit to re-run and no rebuild step. - The approval gate fires on CI's `npm ci`, the one install here that runs diff --git a/package.json b/package.json index 879d98d8a4..bda7197c06 100644 --- a/package.json +++ b/package.json @@ -49,6 +49,7 @@ "update:docsy:main": "hugo mod get -u github.com/google/docsy/theme@main && npm run _update:docsy:post", "update:docsy:mod": "hugo mod get -u github.com/google/docsy/theme && npm run _update:docsy:post", "update:docsy:pack": "hugo mod npm pack && npm pkg set 'name=\"@docsy/hugoautogen\"' private=true --json --prefix packages/hugoautogen && npm install --ignore-scripts", + "update:hugo": "npm install --save-dev --save-exact --ignore-scripts hugo-extended@$npm_config_hugo", "update:main": "npm run update:packages && npm run update:docsy:main", "update:packages": "npm-check-updates -u -x hugo-extended", "update": "npm run update:packages && npm run update:docsy:mod" From 6f1a525a8ab366ec7f4d7c86124cad4e932c1c01 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 12:38:26 -0400 Subject: [PATCH 17/39] Drop update:hugo; approve:hugo syncs the tree first; CONTRIBUTING truths - update:hugo out for good: npm 11.19 warns that unknown run flags stop working in the next major, and the unquoted expansion was an argument-injection point; the bump is the pinned command (r4.1) - approve:hugo runs install:safe first: approve-scripts needs a tree and the manifest regeneration reads it, so a fresh checkout of a bump PR now works (r4.2) - CONTRIBUTING: a consumer's plain npm install runs scripts too, so the gate sentence names CI without "the one"; the Renovate opener was Docsy's sentence; two repeats cut (r4.3-r4.5) --- CONTRIBUTING.md | 21 +++++++++++---------- package.json | 3 +-- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e7bf156cde..51e80b654c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -9,9 +9,9 @@ repo's [main ruleset][] mirrors Docsy's). ### Dependency updates -Renovate opens version-update PRs, configured in `renovate.jsonc`. For the -settings shared with Docsy and their rationale, the action-pin requirements, and -the merge checks, see Docsy's [Dependency updates][]. What differs here: +For the Renovate settings shared with Docsy and their rationale, the action-pin +requirements, and the merge checks, see Docsy's [Dependency updates][]. What +differs here (config: `renovate.jsonc`): - `gomod` off: the Docsy theme pin is updated manually; see [Upgrade Docsy](#upgrade-docsy). @@ -40,8 +40,8 @@ generated package's name, otherwise derived from the checkout-directory name. The Docsy-update scripts run it as their post phase, and CI reruns it to catch drift. If a theme update changes either file, commit the result. Installs themselves declare no lifecycle hooks (guarded by `tests/npm-scripts.test.mjs`), -so neither install mode runs root-package code; `install:safe` remains the -lock-exact path, while a plain `npm install` resolves and may rewrite the lock. +so neither install mode runs root-package code. A plain `npm install` resolves +and may rewrite the lock. ### Upgrade Docsy @@ -61,12 +61,13 @@ npm run update:docsy:main The flow is Docsy's ([Officially supported Hugo version][]). What differs here: -- `npm run update:hugo` pins the newest release the npm cooldown admits; - `--hugo=X.Y.Z` names one. -- `npm run approve:hugo` approves the version and regenerates the theme +- The bump is the plain command, + `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; + there is no `update:hugo` script. +- `npm run approve:hugo` syncs the tree, approves, and regenerates the theme manifest; there is no audit to re-run and no rebuild step. -- The approval gate fires on CI's `npm ci`, the one install here that runs - scripts; so `.npmrc` sets no `ignore-scripts`, unlike Docsy's. +- CI's `npm ci` runs install scripts, which the approval gate needs; so `.npmrc` + leaves `ignore-scripts` unset, unlike Docsy's. ### Develop against a local Docsy diff --git a/package.json b/package.json index bda7197c06..63032692cb 100644 --- a/package.json +++ b/package.json @@ -25,7 +25,7 @@ "_netlify:prepare": "npm run -s _is:clean && npm run install:safe && npm run -s _is:clean", "_serve": "npm run _hugo-dev -- --minify serve --renderToMemory", "_update:docsy:post": "hugo mod tidy && npm run update:docsy:pack", - "approve:hugo": "npm approve-scripts hugo-extended && npm run update:docsy:pack", + "approve:hugo": "npm run install:safe && npm approve-scripts hugo-extended && npm run update:docsy:pack", "build:preview": "npm run _hugo-dev -- --minify --baseURL \"${DEPLOY_PRIME_URL:-/}\"", "build:production": "npm run _hugo -- --minify", "build": "npm run _build -- ", @@ -49,7 +49,6 @@ "update:docsy:main": "hugo mod get -u github.com/google/docsy/theme@main && npm run _update:docsy:post", "update:docsy:mod": "hugo mod get -u github.com/google/docsy/theme && npm run _update:docsy:post", "update:docsy:pack": "hugo mod npm pack && npm pkg set 'name=\"@docsy/hugoautogen\"' private=true --json --prefix packages/hugoautogen && npm install --ignore-scripts", - "update:hugo": "npm install --save-dev --save-exact --ignore-scripts hugo-extended@$npm_config_hugo", "update:main": "npm run update:packages && npm run update:docsy:main", "update:packages": "npm-check-updates -u -x hugo-extended", "update": "npm run update:packages && npm run update:docsy:mod" From eeb671935ad5b3f766f0f5cb4b4c7c1226ae4303 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 12:43:56 -0400 Subject: [PATCH 18/39] CONTRIBUTING: say why ignore-scripts stays unset, not just that CI needs scripts on --- CONTRIBUTING.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 51e80b654c..7cd4e944ec 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -66,8 +66,11 @@ The flow is Docsy's ([Officially supported Hugo version][]). What differs here: there is no `update:hugo` script. - `npm run approve:hugo` syncs the tree, approves, and regenerates the theme manifest; there is no audit to re-run and no rebuild step. -- CI's `npm ci` runs install scripts, which the approval gate needs; so `.npmrc` - leaves `ignore-scripts` unset, unlike Docsy's. +- `.npmrc` leaves `ignore-scripts` unset, unlike Docsy's: npm checks the + `allowScripts` approval only on an install that would run scripts, so CI's + `npm ci` must be one for an unapproved hugo-extended bump to fail CI. Docsy + can set it because its install re-enables scripts for hugo-extended alone; + this repo has no such step. ### Develop against a local Docsy From 6e57835bc7f6222830f5d6096ec4b0a5e66916bd Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 12:58:37 -0400 Subject: [PATCH 19/39] CONTRIBUTING: Update Hugo leads with the property CI enforces; .npmrc's two exceptions get their own section The approval gate's purpose (a maintainer has approved every hugo-extended version whose installer may run) was missing; the mechanics had crowded it out. The harmonizer's question (why no ignore-scripts) now has its own home, which the .npmrc pointer targets. --- .npmrc | 2 +- CONTRIBUTING.md | 25 +++++++++++++++++++------ 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/.npmrc b/.npmrc index b0771b80d6..dbda8fe952 100644 --- a/.npmrc +++ b/.npmrc @@ -4,7 +4,7 @@ min-release-age=7 strict-allow-scripts=true engine-strict=true -# No ignore-scripts setting here: see CONTRIBUTING.md#update-hugo. +# No ignore-scripts setting here: see CONTRIBUTING.md#install-configuration. # Windows npm defaults to cmd.exe, whose quoting silently diverges from sh. script-shell=bash diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 7cd4e944ec..0389d1288a 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -43,6 +43,20 @@ themselves declare no lifecycle hooks (guarded by `tests/npm-scripts.test.mjs`), so neither install mode runs root-package code. A plain `npm install` resolves and may rewrite the lock. +### Install configuration + +`.npmrc` follows Docsy's, with two exceptions: + +- Docsy's `@docsy:registry` pin is publisher-only. +- Docsy sets `ignore-scripts=true`; this repo does not. npm checks + `allowScripts` approvals only on an install that would run scripts. With every + install script-free, no check runs anywhere, and a hugo-extended bump with no + approval on record merges green: the property in [Update Hugo](#update-hugo) + is lost. Docsy keeps the property under `ignore-scripts=true` because its + install re-enables scripts for hugo-extended alone, in a rebuild step this + repo does not carry; here, CI's `npm ci` is the script-enabled install where + the check runs. + ### Upgrade Docsy Update Docsy to the latest tagged release: @@ -59,18 +73,17 @@ npm run update:docsy:main ### Update Hugo -The flow is Docsy's ([Officially supported Hugo version][]). What differs here: +hugo-extended's installer downloads and executes a binary, so every version that +may run it here carries a recorded maintainer approval (`allowScripts`), and CI +enforces it: an unapproved bump fails `npm ci` (`strict-allow-scripts`, in +`.npmrc`). The two-step flow that keeps the approval current is Docsy's +([Officially supported Hugo version][]). What differs here: - The bump is the plain command, `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; there is no `update:hugo` script. - `npm run approve:hugo` syncs the tree, approves, and regenerates the theme manifest; there is no audit to re-run and no rebuild step. -- `.npmrc` leaves `ignore-scripts` unset, unlike Docsy's: npm checks the - `allowScripts` approval only on an install that would run scripts, so CI's - `npm ci` must be one for an unapproved hugo-extended bump to fail CI. Docsy - can set it because its install re-enables scripts for hugo-extended alone; - this repo has no such step. ### Develop against a local Docsy From 9d93209869973f89774da28255ae7f813fdb44b2 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 13:11:56 -0400 Subject: [PATCH 20/39] =?UTF-8?q?CONTRIBUTING=20=C2=A7=20Update=20Hugo:=20?= =?UTF-8?q?the=20key=20name=20is=20Install=20configuration's;=20the=20main?= =?UTF-8?q?tainer=20needs=20the=20consequence?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CONTRIBUTING.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0389d1288a..a3e6575119 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -75,9 +75,9 @@ npm run update:docsy:main hugo-extended's installer downloads and executes a binary, so every version that may run it here carries a recorded maintainer approval (`allowScripts`), and CI -enforces it: an unapproved bump fails `npm ci` (`strict-allow-scripts`, in -`.npmrc`). The two-step flow that keeps the approval current is Docsy's -([Officially supported Hugo version][]). What differs here: +enforces it: an unapproved bump fails `npm ci`. The two-step flow that keeps the +approval current is Docsy's ([Officially supported Hugo version][]). What +differs here: - The bump is the plain command, `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; From 0773ab2ccbf70e5a0a39d3066c6000469807cfbc Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 13:57:38 -0400 Subject: [PATCH 21/39] Drop the Renovate timezone; CONTRIBUTING round-5 wording - timezone was a vestige of docsy's one-day phrase schedule (docsy#2742), copied by #492 the day docsy#2747 dropped it; the cron runs in UTC like every family repo's, and the comment says so - Install configuration: the registry-pin line states this repo's delta; a plain npm install runs hugo-extended's installer and needs network (the consumer-facing consequence of keeping scripts on) - Lockfile and Update Hugo: a dangling "neither install mode" and a front-loaded bump line (r5 prose) --- CONTRIBUTING.md | 15 ++++++++------- renovate.jsonc | 3 +-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a3e6575119..e9f8015700 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -40,14 +40,14 @@ generated package's name, otherwise derived from the checkout-directory name. The Docsy-update scripts run it as their post phase, and CI reruns it to catch drift. If a theme update changes either file, commit the result. Installs themselves declare no lifecycle hooks (guarded by `tests/npm-scripts.test.mjs`), -so neither install mode runs root-package code. A plain `npm install` resolves -and may rewrite the lock. +so installs run no root-package code. A plain `npm install` resolves and may +rewrite the lock. ### Install configuration `.npmrc` follows Docsy's, with two exceptions: -- Docsy's `@docsy:registry` pin is publisher-only. +- No `@docsy:registry` pin: this repo publishes no packages. - Docsy sets `ignore-scripts=true`; this repo does not. npm checks `allowScripts` approvals only on an install that would run scripts. With every install script-free, no check runs anywhere, and a hugo-extended bump with no @@ -55,7 +55,9 @@ and may rewrite the lock. is lost. Docsy keeps the property under `ignore-scripts=true` because its install re-enables scripts for hugo-extended alone, in a rebuild step this repo does not carry; here, CI's `npm ci` is the script-enabled install where - the check runs. + the check runs. So is a plain `npm install`, which therefore runs + hugo-extended's installer and needs network access; `npm run install:safe` + runs no scripts. ### Upgrade Docsy @@ -79,9 +81,8 @@ enforces it: an unapproved bump fails `npm ci`. The two-step flow that keeps the approval current is Docsy's ([Officially supported Hugo version][]). What differs here: -- The bump is the plain command, - `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; - there is no `update:hugo` script. +- No `update:hugo` script; the bump is + `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`. - `npm run approve:hugo` syncs the tree, approves, and regenerates the theme manifest; there is no audit to re-run and no rebuild step. diff --git a/renovate.jsonc b/renovate.jsonc index c4920b3279..3662b2a5cb 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -5,8 +5,7 @@ // CONTRIBUTING.md#dependency-updates "ignorePresets": ["security:minimumReleaseAgeNpm"], "lockFileMaintenance": { "enabled": false }, - "timezone": "America/Montreal", - "schedule": ["* * * * 0"], // Sunday + "schedule": ["* * * * 0"], // Sunday (UTC) "labels": ["dependencies"], "gomod": { "enabled": false }, "minimumReleaseAge": "7 days", From ab97a6f4757dee1a07a7f694a7ff3976bbc2d7b6 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Fri, 25 Sep 2026 14:38:04 -0400 Subject: [PATCH 22/39] Pin the Renovate schedule to UTC; the Hugo pin's policy and the cooldown override said; approve pins by version - timezone: UTC explicit: unset, Renovate evaluates the cron in the host's zone, so "Sunday (UTC)" was only true on a UTC host (r6.1) - Update Hugo: the pin tracks Docsy's officially supported version (the delta a dropped bullet had left homeless); a bump under the cooldown takes the env override on the install command; approve:hugo's bullet keeps its deltas and points at the manifest section (r6.2, r6.3) - approve:hugo passes --allow-scripts-pin so a user-level allow-scripts-pin=false cannot write a name-level allow (r6.5) - Install configuration: the counterfactual reads as one (r6.4); two colons fixed; Upgrade Docsy linked --- CONTRIBUTING.md | 33 +++++++++++++++++++-------------- package.json | 2 +- renovate.jsonc | 3 ++- 3 files changed, 22 insertions(+), 16 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e9f8015700..1b1238ec89 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -11,14 +11,14 @@ repo's [main ruleset][] mirrors Docsy's). For the Renovate settings shared with Docsy and their rationale, the action-pin requirements, and the merge checks, see Docsy's [Dependency updates][]. What -differs here (config: `renovate.jsonc`): +differs in `renovate.jsonc`: - `gomod` off: the Docsy theme pin is updated manually; see [Upgrade Docsy](#upgrade-docsy). - Bootstrap and Font Awesome updates arrive through the theme: `packages/hugoautogen` is regenerated from it, reverting any direct bump. If a Dependabot security PR bumps them directly, close it and route the fix through - a theme update. + a theme update ([Upgrade Docsy](#upgrade-docsy)). - No audit test guards the action-pin comments here; the PR reviewer checks them. @@ -49,15 +49,15 @@ rewrite the lock. - No `@docsy:registry` pin: this repo publishes no packages. - Docsy sets `ignore-scripts=true`; this repo does not. npm checks - `allowScripts` approvals only on an install that would run scripts. With every - install script-free, no check runs anywhere, and a hugo-extended bump with no - approval on record merges green: the property in [Update Hugo](#update-hugo) - is lost. Docsy keeps the property under `ignore-scripts=true` because its - install re-enables scripts for hugo-extended alone, in a rebuild step this - repo does not carry; here, CI's `npm ci` is the script-enabled install where - the check runs. So is a plain `npm install`, which therefore runs - hugo-extended's installer and needs network access; `npm run install:safe` - runs no scripts. + `allowScripts` approvals only on an install that would run scripts. If this + repo set `ignore-scripts=true`, no check would run anywhere and a + hugo-extended bump with no approval on record would merge green: the property + in [Update Hugo](#update-hugo) would be lost. Docsy keeps the property under + `ignore-scripts=true` because its install re-enables scripts for hugo-extended + alone, in a rebuild step this repo does not carry; here, CI's `npm ci` is the + script-enabled install where the check runs. So is a plain `npm install`, + which therefore runs hugo-extended's installer and needs network access; + `npm run install:safe` runs no scripts. ### Upgrade Docsy @@ -81,10 +81,15 @@ enforces it: an unapproved bump fails `npm ci`. The two-step flow that keeps the approval current is Docsy's ([Officially supported Hugo version][]). What differs here: +- The pin tracks Docsy's officially supported version, not an independent + latest; Renovate does not propose hugo-extended bumps. - No `update:hugo` script; the bump is - `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`. -- `npm run approve:hugo` syncs the tree, approves, and regenerates the theme - manifest; there is no audit to re-run and no rebuild step. + `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`. A + release younger than the npm cooldown needs `NPM_CONFIG_MIN_RELEASE_AGE` set + to its age on that command. +- `npm run approve:hugo` has no audit to re-run and no rebuild step; it syncs + the tree first, then approves and regenerates the manifest + ([Lockfile and generated manifest](#lockfile-and-generated-manifest)). ### Develop against a local Docsy diff --git a/package.json b/package.json index 63032692cb..0870f28f2e 100644 --- a/package.json +++ b/package.json @@ -25,7 +25,7 @@ "_netlify:prepare": "npm run -s _is:clean && npm run install:safe && npm run -s _is:clean", "_serve": "npm run _hugo-dev -- --minify serve --renderToMemory", "_update:docsy:post": "hugo mod tidy && npm run update:docsy:pack", - "approve:hugo": "npm run install:safe && npm approve-scripts hugo-extended && npm run update:docsy:pack", + "approve:hugo": "npm run install:safe && npm approve-scripts --allow-scripts-pin hugo-extended && npm run update:docsy:pack", "build:preview": "npm run _hugo-dev -- --minify --baseURL \"${DEPLOY_PRIME_URL:-/}\"", "build:production": "npm run _hugo -- --minify", "build": "npm run _build -- ", diff --git a/renovate.jsonc b/renovate.jsonc index 3662b2a5cb..02c57517ba 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -5,7 +5,8 @@ // CONTRIBUTING.md#dependency-updates "ignorePresets": ["security:minimumReleaseAgeNpm"], "lockFileMaintenance": { "enabled": false }, - "schedule": ["* * * * 0"], // Sunday (UTC) + "timezone": "UTC", // The schedule runs in the evaluator host's zone otherwise. + "schedule": ["* * * * 0"], // Sunday "labels": ["dependencies"], "gomod": { "enabled": false }, "minimumReleaseAge": "7 days", From c6d542ed7b0a79216a8765a825de396b28897c7a Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 07:34:16 -0400 Subject: [PATCH 23/39] Update Hugo states the approval at its true strength; delta leaks and comment claims fixed - The approval covers the install script only and CI flags, not blocks: the bin wrapper runs the same installer at first use, and check-links is not a required check (r7.1) - The Renovate-exclusion clause was Docsy's; the live bot path, a Dependabot security bump, is the delta (r7.2) - Cooldown override by pointer to Docsy's, with the whole-days rule; Docsy's rebuild mechanism by pointer; the third "install:safe runs no scripts" cut (r7.6, r7.7) - engine-strict gets its one why back; the ignore-scripts pointer stands in its own block; the timezone comment names Renovate's docs and code (r7.4, r7.5) --- .npmrc | 2 ++ CONTRIBUTING.md | 39 +++++++++++++++++++++------------------ renovate.jsonc | 4 +++- 3 files changed, 26 insertions(+), 19 deletions(-) diff --git a/.npmrc b/.npmrc index dbda8fe952..256168c81c 100644 --- a/.npmrc +++ b/.npmrc @@ -3,7 +3,9 @@ min-release-age=7 strict-allow-scripts=true +# An npm below the engines floor ignores allowScripts silently; fail instead. engine-strict=true + # No ignore-scripts setting here: see CONTRIBUTING.md#install-configuration. # Windows npm defaults to cmd.exe, whose quoting silently diverges from sh. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1b1238ec89..41e8cc31e0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -10,8 +10,8 @@ repo's [main ruleset][] mirrors Docsy's). ### Dependency updates For the Renovate settings shared with Docsy and their rationale, the action-pin -requirements, and the merge checks, see Docsy's [Dependency updates][]. What -differs in `renovate.jsonc`: +requirements, and the action-bump merge checks, see Docsy's [Dependency +updates][]. What differs here: - `gomod` off: the Docsy theme pin is updated manually; see [Upgrade Docsy](#upgrade-docsy). @@ -51,13 +51,13 @@ rewrite the lock. - Docsy sets `ignore-scripts=true`; this repo does not. npm checks `allowScripts` approvals only on an install that would run scripts. If this repo set `ignore-scripts=true`, no check would run anywhere and a - hugo-extended bump with no approval on record would merge green: the property - in [Update Hugo](#update-hugo) would be lost. Docsy keeps the property under - `ignore-scripts=true` because its install re-enables scripts for hugo-extended - alone, in a rebuild step this repo does not carry; here, CI's `npm ci` is the - script-enabled install where the check runs. So is a plain `npm install`, - which therefore runs hugo-extended's installer and needs network access; - `npm run install:safe` runs no scripts. + hugo-extended bump with no approval on record would arrive with a green + `check-links`: the review record in [Update Hugo](#update-hugo) would be lost. + Docsy keeps it through the rebuild step of its approval flow ([Officially + supported Hugo version][]), which this repo does not carry; here, CI's + `npm ci` is the script-enabled install where the check runs. So is a plain + `npm install`, which therefore runs hugo-extended's installer and needs + network access. ### Upgrade Docsy @@ -75,20 +75,23 @@ npm run update:docsy:main ### Update Hugo -hugo-extended's installer downloads and executes a binary, so every version that -may run it here carries a recorded maintainer approval (`allowScripts`), and CI -enforces it: an unapproved bump fails `npm ci`. The two-step flow that keeps the +hugo-extended's installer downloads and executes a binary. Every pinned version +has a maintainer approval on record (`allowScripts`), and CI flags a bump +without one: `npm ci` fails. The approval covers the install script only; the +binary self-installs at first use regardless. The two-step flow that keeps the approval current is Docsy's ([Officially supported Hugo version][]). What differs here: - The pin tracks Docsy's officially supported version, not an independent - latest; Renovate does not propose hugo-extended bumps. -- No `update:hugo` script; the bump is + latest. A Dependabot security PR that bumps it fails `npm ci` until the bump + is approved. +- No `update:hugo` script: the bump is `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`. A - release younger than the npm cooldown needs `NPM_CONFIG_MIN_RELEASE_AGE` set - to its age on that command. -- `npm run approve:hugo` has no audit to re-run and no rebuild step; it syncs - the tree first, then approves and regenerates the manifest + release younger than the npm cooldown takes Docsy's + [`NPM_CONFIG_MIN_RELEASE_AGE` override][Dependency updates] on that command, + set no higher than the release's age in whole days. +- `npm run approve:hugo` has no audit to re-run and no rebuild step; instead it + ends by regenerating the manifest ([Lockfile and generated manifest](#lockfile-and-generated-manifest)). ### Develop against a local Docsy diff --git a/renovate.jsonc b/renovate.jsonc index 02c57517ba..18cb4cfd57 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -5,7 +5,9 @@ // CONTRIBUTING.md#dependency-updates "ignorePresets": ["security:minimumReleaseAgeNpm"], "lockFileMaintenance": { "enabled": false }, - "timezone": "UTC", // The schedule runs in the evaluator host's zone otherwise. + // Unset, the cron is evaluated in the zone of the host running Renovate; + // Renovate's docs say UTC. Pin it. + "timezone": "UTC", "schedule": ["* * * * 0"], // Sunday "labels": ["dependencies"], "gomod": { "enabled": false }, From fdabf08d04611a392a613b77bcdb8ec61f91866e Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 07:51:36 -0400 Subject: [PATCH 24/39] Update Hugo: the pin's policy first, then the update command, in the maintainer's order - The policy names what the example follows and what to do with a Dependabot bump; the command reads as an instruction, the missing script as its trailing why (owner's wording pass) - renovate.jsonc: schedule first, the UTC pin as its rider (owner's edit) --- CONTRIBUTING.md | 28 ++++++++++++++-------------- renovate.jsonc | 4 +--- 2 files changed, 15 insertions(+), 17 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 41e8cc31e0..112bbe94bf 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -79,20 +79,19 @@ hugo-extended's installer downloads and executes a binary. Every pinned version has a maintainer approval on record (`allowScripts`), and CI flags a bump without one: `npm ci` fails. The approval covers the install script only; the binary self-installs at first use regardless. The two-step flow that keeps the -approval current is Docsy's ([Officially supported Hugo version][]). What -differs here: - -- The pin tracks Docsy's officially supported version, not an independent - latest. A Dependabot security PR that bumps it fails `npm ci` until the bump - is approved. -- No `update:hugo` script: the bump is - `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`. A - release younger than the npm cooldown takes Docsy's - [`NPM_CONFIG_MIN_RELEASE_AGE` override][Dependency updates] on that command, - set no higher than the release's age in whole days. +approval current is Docsy's. What differs here: + +- The pin tracks Docsy's [officially supported version][]. Approve a Dependabot + security bump only if Docsy has moved or is about to; otherwise route it + through Docsy first. Until approved, the bump fails `npm ci`. +- Update the pin with + `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; + this repo has no `update:hugo` script. For a release younger than the npm + cooldown, add Docsy's [`NPM_CONFIG_MIN_RELEASE_AGE` + override][Dependency updates] to that command, set no higher than the + release's age in whole days. - `npm run approve:hugo` has no audit to re-run and no rebuild step; instead it - ends by regenerating the manifest - ([Lockfile and generated manifest](#lockfile-and-generated-manifest)). + ends by regenerating the manifest ([Lockfile and generated manifest][]). ### Develop against a local Docsy @@ -116,7 +115,8 @@ watches it, so theme edits hot-reload. [Hugo workspace]: https://gohugo.io/configuration/module/#top-level-settings [main ruleset]: https://github.com/docsy/docsy-example/rules/23697395 [Merge requirements]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#merge-requirements -[Officially supported Hugo version]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#official-hugo-version +[officially supported version]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#official-hugo-version +[Lockfile and generated manifest]: #lockfile-and-generated-manifest [workflow security analysis]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#workflow-security-analysis diff --git a/renovate.jsonc b/renovate.jsonc index 18cb4cfd57..60c5e96bf0 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -5,10 +5,8 @@ // CONTRIBUTING.md#dependency-updates "ignorePresets": ["security:minimumReleaseAgeNpm"], "lockFileMaintenance": { "enabled": false }, - // Unset, the cron is evaluated in the zone of the host running Renovate; - // Renovate's docs say UTC. Pin it. - "timezone": "UTC", "schedule": ["* * * * 0"], // Sunday + "timezone": "UTC", // Pin for consistency rather than host's zone "labels": ["dependencies"], "gomod": { "enabled": false }, "minimumReleaseAge": "7 days", From 1cd598803f756be535e49350c4bc53fe2472f1d5 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 07:52:45 -0400 Subject: [PATCH 25/39] Update Hugo: "the pin" was ambiguous (the repo pins more than versions); the heading carries the object --- CONTRIBUTING.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 112bbe94bf..96af377de1 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -81,10 +81,10 @@ without one: `npm ci` fails. The approval covers the install script only; the binary self-installs at first use regardless. The two-step flow that keeps the approval current is Docsy's. What differs here: -- The pin tracks Docsy's [officially supported version][]. Approve a Dependabot - security bump only if Docsy has moved or is about to; otherwise route it - through Docsy first. Until approved, the bump fails `npm ci`. -- Update the pin with +- The version tracks Docsy's [officially supported version][]. Approve a + Dependabot security bump only if Docsy has moved or is about to; otherwise + route it through Docsy first. Until approved, the bump fails `npm ci`. +- Update using `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; this repo has no `update:hugo` script. For a release younger than the npm cooldown, add Docsy's [`NPM_CONFIG_MIN_RELEASE_AGE` From 9dc0a92583500b3479377f69e57c2769cb859b6f Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 07:55:20 -0400 Subject: [PATCH 26/39] Install configuration: the ignore-scripts exception answers first, then its three parts as sub-bullets; a dangling link reference removed with the restated pointer --- CONTRIBUTING.md | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 96af377de1..230c134544 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -48,16 +48,15 @@ rewrite the lock. `.npmrc` follows Docsy's, with two exceptions: - No `@docsy:registry` pin: this repo publishes no packages. -- Docsy sets `ignore-scripts=true`; this repo does not. npm checks - `allowScripts` approvals only on an install that would run scripts. If this - repo set `ignore-scripts=true`, no check would run anywhere and a - hugo-extended bump with no approval on record would arrive with a green - `check-links`: the review record in [Update Hugo](#update-hugo) would be lost. - Docsy keeps it through the rebuild step of its approval flow ([Officially - supported Hugo version][]), which this repo does not carry; here, CI's - `npm ci` is the script-enabled install where the check runs. So is a plain - `npm install`, which therefore runs hugo-extended's installer and needs - network access. +- No `ignore-scripts=true`: the `allowScripts` check in + [Update Hugo](#update-hugo) runs only on an install that runs scripts, and + this repo needs one to exist. + - Here, CI's `npm ci` is that install; so is a plain `npm install`, which + therefore runs hugo-extended's installer and needs network access. + - Docsy can set the key because its approval flow re-enables scripts for + hugo-extended alone, in a rebuild step this repo does not carry. + - With the key set, an unapproved hugo-extended bump would arrive with a green + `check-links`. ### Upgrade Docsy From 399b5b4731c067f397648a6cf7445228ccfa7de1 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 08:19:02 -0400 Subject: [PATCH 27/39] Update Hugo: the cooldown bound is Docsy's to state; two comments that restated their keys - The override clause inverted Docsy's guidance (smallest relaxation that admits the release); the pointer alone is right (r8.1) - The repeated "fails npm ci" sentence cut; the flow sentence links Docsy's section again (r8.2, r8.3) - .npmrc: the engine-strict comment misfiled the floor's reason on the strict key (an install the floor refuses ignores nothing); renovate.jsonc: "// Sunday" translated the cron - Link definitions back in alphabetical order --- .npmrc | 2 -- CONTRIBUTING.md | 9 ++++----- renovate.jsonc | 2 +- 3 files changed, 5 insertions(+), 8 deletions(-) diff --git a/.npmrc b/.npmrc index 256168c81c..dbda8fe952 100644 --- a/.npmrc +++ b/.npmrc @@ -3,9 +3,7 @@ min-release-age=7 strict-allow-scripts=true -# An npm below the engines floor ignores allowScripts silently; fail instead. engine-strict=true - # No ignore-scripts setting here: see CONTRIBUTING.md#install-configuration. # Windows npm defaults to cmd.exe, whose quoting silently diverges from sh. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 230c134544..4d09c22286 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -78,17 +78,16 @@ hugo-extended's installer downloads and executes a binary. Every pinned version has a maintainer approval on record (`allowScripts`), and CI flags a bump without one: `npm ci` fails. The approval covers the install script only; the binary self-installs at first use regardless. The two-step flow that keeps the -approval current is Docsy's. What differs here: +approval current is [Docsy's][officially supported version]. What differs here: - The version tracks Docsy's [officially supported version][]. Approve a Dependabot security bump only if Docsy has moved or is about to; otherwise - route it through Docsy first. Until approved, the bump fails `npm ci`. + route it through Docsy first. - Update using `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; this repo has no `update:hugo` script. For a release younger than the npm cooldown, add Docsy's [`NPM_CONFIG_MIN_RELEASE_AGE` - override][Dependency updates] to that command, set no higher than the - release's age in whole days. + override][Dependency updates] to that command. - `npm run approve:hugo` has no audit to re-run and no rebuild step; instead it ends by regenerating the manifest ([Lockfile and generated manifest][]). @@ -112,10 +111,10 @@ watches it, so theme edits hot-reload. [deploys]: https://app.netlify.com/sites/docsy-example/deploys [Docsy]: https://github.com/docsy/docsy [Hugo workspace]: https://gohugo.io/configuration/module/#top-level-settings +[Lockfile and generated manifest]: #lockfile-and-generated-manifest [main ruleset]: https://github.com/docsy/docsy-example/rules/23697395 [Merge requirements]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#merge-requirements [officially supported version]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#official-hugo-version -[Lockfile and generated manifest]: #lockfile-and-generated-manifest [workflow security analysis]: https://main--docsydocs.netlify.app/project/about/maintainer-notes/#workflow-security-analysis diff --git a/renovate.jsonc b/renovate.jsonc index 60c5e96bf0..7bf94592c6 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -5,7 +5,7 @@ // CONTRIBUTING.md#dependency-updates "ignorePresets": ["security:minimumReleaseAgeNpm"], "lockFileMaintenance": { "enabled": false }, - "schedule": ["* * * * 0"], // Sunday + "schedule": ["* * * * 0"], "timezone": "UTC", // Pin for consistency rather than host's zone "labels": ["dependencies"], "gomod": { "enabled": false }, From 21a778bc734ffb8f19ee42a95a7c204bfaaf0de5 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 08:27:48 -0400 Subject: [PATCH 28/39] renovate.jsonc: the timezone key states its own effect; its reason belongs with the family's schedule guidance --- renovate.jsonc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.jsonc b/renovate.jsonc index 7bf94592c6..a2e52a4c74 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -6,7 +6,7 @@ "ignorePresets": ["security:minimumReleaseAgeNpm"], "lockFileMaintenance": { "enabled": false }, "schedule": ["* * * * 0"], - "timezone": "UTC", // Pin for consistency rather than host's zone + "timezone": "UTC", "labels": ["dependencies"], "gomod": { "enabled": false }, "minimumReleaseAge": "7 days", From f4e64870d2d1eb153c071ffb097c6b15ce9268e1 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 09:04:52 -0400 Subject: [PATCH 29/39] Update Hugo: a Dependabot PR for hugo-extended is closed, not approved; the enforcement-site sentences bounded - The policy sentence was not a procedure and "is about to" let this repo lead Docsy; Dependabot's hugo-extended PRs (#475, #445) change package.json alone, so npm ci fails on the lock before any approval check: close, update to Docsy's version, approve (r9.1) - A plain npm install runs scripts only without a user-level ignore-scripts; install:safe never fails on a missing approval, unlike in Docsy's flow; the counterfactual holds for a lock-synced bump (r9.2-r9.4) - Generated sites set their own Hugo version (r9.5); the hugo-extended exclusion indexed from Dependency updates (r9.7); the Bootstrap/FA bullet starts at the delta; "no rebuild step" once; "the lockfile and the manifest" - .npmrc: the pointer's blank line back; renovate.jsonc: "Updates through Docsy." restated CONTRIBUTING --- CONTRIBUTING.md | 31 ++++++++++++++++++------------- renovate.jsonc | 1 - 2 files changed, 18 insertions(+), 14 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4d09c22286..b8429b8eea 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -15,10 +15,11 @@ updates][]. What differs here: - `gomod` off: the Docsy theme pin is updated manually; see [Upgrade Docsy](#upgrade-docsy). -- Bootstrap and Font Awesome updates arrive through the theme: - `packages/hugoautogen` is regenerated from it, reverting any direct bump. If a - Dependabot security PR bumps them directly, close it and route the fix through - a theme update ([Upgrade Docsy](#upgrade-docsy)). +- `hugo-extended` off: see [Update Hugo](#update-hugo). +- `packages/hugoautogen` is regenerated from the theme, reverting any direct + Bootstrap or Font Awesome bump. If a Dependabot security PR bumps them + directly, close it and route the fix through a theme update + ([Upgrade Docsy](#upgrade-docsy)). - No audit test guards the action-pin comments here; the PR reviewer checks them. @@ -51,12 +52,14 @@ rewrite the lock. - No `ignore-scripts=true`: the `allowScripts` check in [Update Hugo](#update-hugo) runs only on an install that runs scripts, and this repo needs one to exist. - - Here, CI's `npm ci` is that install; so is a plain `npm install`, which - therefore runs hugo-extended's installer and needs network access. + - Here, CI's `npm ci` is that install, and so is a plain `npm install` unless + a user-level `ignore-scripts` is set; either runs hugo-extended's installer + and needs network access. `npm run install:safe` runs no scripts, so unlike + in Docsy's flow it never fails on a missing approval. - Docsy can set the key because its approval flow re-enables scripts for - hugo-extended alone, in a rebuild step this repo does not carry. - - With the key set, an unapproved hugo-extended bump would arrive with a green - `check-links`. + hugo-extended alone ([Update Hugo](#update-hugo)). + - With the key set, a lock-synced hugo-extended bump with no approval would + arrive with a green `check-links`. ### Upgrade Docsy @@ -80,16 +83,18 @@ without one: `npm ci` fails. The approval covers the install script only; the binary self-installs at first use regardless. The two-step flow that keeps the approval current is [Docsy's][officially supported version]. What differs here: -- The version tracks Docsy's [officially supported version][]. Approve a - Dependabot security bump only if Docsy has moved or is about to; otherwise - route it through Docsy first. +- The version tracks Docsy's [officially supported version][] (a site generated + from this template sets its own). Close a Dependabot security PR for + hugo-extended; update to the version Docsy pins, with the command below, then + approve. - Update using `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; this repo has no `update:hugo` script. For a release younger than the npm cooldown, add Docsy's [`NPM_CONFIG_MIN_RELEASE_AGE` override][Dependency updates] to that command. - `npm run approve:hugo` has no audit to re-run and no rebuild step; instead it - ends by regenerating the manifest ([Lockfile and generated manifest][]). + ends by regenerating the lockfile and the manifest ([Lockfile and generated + manifest][]). ### Develop against a local Docsy diff --git a/renovate.jsonc b/renovate.jsonc index a2e52a4c74..11dc969737 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -34,7 +34,6 @@ "enabled": false, }, { - // Updates through Docsy. "matchPackageNames": ["bootstrap", "@fortawesome/fontawesome-free"], "enabled": false, }, From 7c82f52ad0270098512a30ba3fcb61344a4532da Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 09:10:46 -0400 Subject: [PATCH 30/39] Dependency updates: say what Renovate does, not the config value ("off" was config-speak) --- .cspell.yml | 4 +++- CONTRIBUTING.md | 5 ++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.cspell.yml b/.cspell.yml index 7071f22526..f247eaf923 100644 --- a/.cspell.yml +++ b/.cspell.yml @@ -1,4 +1,4 @@ -version: '0.2' +version: "0.2" caseSensitive: true words: - chalin @@ -8,4 +8,6 @@ words: - github - gohugoio - Goldydocs + - gomod + - hugoautogen - pageinfo diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index b8429b8eea..b6fd37ed6b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -13,9 +13,8 @@ For the Renovate settings shared with Docsy and their rationale, the action-pin requirements, and the action-bump merge checks, see Docsy's [Dependency updates][]. What differs here: -- `gomod` off: the Docsy theme pin is updated manually; see - [Upgrade Docsy](#upgrade-docsy). -- `hugo-extended` off: see [Update Hugo](#update-hugo). +- `gomod` is updated manually, see [Upgrade Docsy](#upgrade-docsy). +- `hugo-extended` is updated manually, see [Update Hugo](#update-hugo). - `packages/hugoautogen` is regenerated from the theme, reverting any direct Bootstrap or Font Awesome bump. If a Dependabot security PR bumps them directly, close it and route the fix through a theme update From 29adc991cdf8a8eefe3d56740dee5b04d468bd2f Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 09:21:27 -0400 Subject: [PATCH 31/39] Dependency updates: the delta list in one register (cause, consequence, link on the action); the Bootstrap/FA routing generalized to any security PR --- CONTRIBUTING.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index b6fd37ed6b..6adaf2d19a 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -13,12 +13,11 @@ For the Renovate settings shared with Docsy and their rationale, the action-pin requirements, and the action-bump merge checks, see Docsy's [Dependency updates][]. What differs here: -- `gomod` is updated manually, see [Upgrade Docsy](#upgrade-docsy). +- The `gomod` manager is disabled; Docsy is [updated manually](#upgrade-docsy). - `hugo-extended` is updated manually, see [Update Hugo](#update-hugo). - `packages/hugoautogen` is regenerated from the theme, reverting any direct - Bootstrap or Font Awesome bump. If a Dependabot security PR bumps them - directly, close it and route the fix through a theme update - ([Upgrade Docsy](#upgrade-docsy)). + Bootstrap or Font Awesome bump. If a security PR bumps them directly, route + the fix through a [Docsy update](#upgrade-docsy). - No audit test guards the action-pin comments here; the PR reviewer checks them. From 081a3715241a21825f6c76d05711c640ff9a4333 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 09:22:53 -0400 Subject: [PATCH 32/39] Update Hugo: the security-PR sentence in the Bootstrap/FA bullet's shape (any security PR; the update is the answer, closing it follows) --- CONTRIBUTING.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6adaf2d19a..572d70e455 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -82,9 +82,8 @@ binary self-installs at first use regardless. The two-step flow that keeps the approval current is [Docsy's][officially supported version]. What differs here: - The version tracks Docsy's [officially supported version][] (a site generated - from this template sets its own). Close a Dependabot security PR for - hugo-extended; update to the version Docsy pins, with the command below, then - approve. + from this template sets its own). If a security PR bumps it, update to the + version Docsy pins instead, with the command below, then approve. - Update using `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; this repo has no `update:hugo` script. For a release younger than the npm From e2965cc0a496dd0b2867e69f50cc0e6bce1a6735 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 09:25:51 -0400 Subject: [PATCH 33/39] .cspell.yml: single quotes (prettier) --- .cspell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cspell.yml b/.cspell.yml index f247eaf923..3e99a4312a 100644 --- a/.cspell.yml +++ b/.cspell.yml @@ -1,4 +1,4 @@ -version: "0.2" +version: '0.2' caseSensitive: true words: - chalin From 626129ebc3328817e4d77a1de2cd3e54049c4e70 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 09:28:44 -0400 Subject: [PATCH 34/39] renovate.jsonc: the runner-label comment says the rule's effect, not Renovate's model --- renovate.jsonc | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/renovate.jsonc b/renovate.jsonc index 11dc969737..d409d9631e 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -22,9 +22,8 @@ "matchManagers": ["!github-actions"], }, { - // Runner labels (runs-on) are github-actions deps too, with no Releases - // to look up. "matchManagers": ["github-actions"], + // Exclude "runs-on" labels: they have no releases to look up. "matchDepTypes": ["action", "workflow"], "overrideDatasource": "github-releases", "branchTopic": "{{{depNameSanitized}}}-{{{newDigest}}}", From 15519b1dfd0d5c18c9f395a03024fc8e4070ca0e Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 10:14:39 -0400 Subject: [PATCH 35/39] Update Hugo: a security fix arrives through Docsy; the enforcement site named where it is edited - The security-PR sentence answered the wrong case: an advisory reaches both repos the same day, so "the version Docsy pins" was the vulnerable one; the fix comes through Docsy, and the update follows it (r10.1) - Install configuration: Docsy's re-enable site is its install:safe rebuild step, run by its CI, not the approval flow; the property paragraph links the installs that run scripts (r10.2, r10.4) - approve:hugo's tail described by its effect: the hugo call self-installs the just-approved binary (r10.5); the Lockfile section names approve:hugo among update:docsy:pack's callers, and manifests declare hooks, installs run them (r10.8) - links.yaml: the one automated install that evaluates allowScripts says so at the line (r10.3); renovate.jsonc: the runner-label comment states the mechanism; cspell ignore trued (r10.6, r10.7) --- .github/workflows/links.yaml | 2 ++ CONTRIBUTING.md | 35 ++++++++++++++++++++--------------- renovate.jsonc | 5 +++-- 3 files changed, 25 insertions(+), 17 deletions(-) diff --git a/.github/workflows/links.yaml b/.github/workflows/links.yaml index efe3788054..af73c642ff 100644 --- a/.github/workflows/links.yaml +++ b/.github/workflows/links.yaml @@ -27,6 +27,8 @@ jobs: node-version-file: .nvmrc cache: npm + # Scripts on: the one automated install that evaluates allowScripts + # (CONTRIBUTING.md#install-configuration). - run: npm ci - name: Regenerate generated files (drift-check input) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 572d70e455..1d147381f6 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -36,11 +36,11 @@ exactly what they pin. Both files are regenerated by `npm run update:docsy:pack`, which, unlike `install:safe`, needs `go` at run time (`hugo mod`); it also normalizes the generated package's name, otherwise derived from the checkout-directory name. -The Docsy-update scripts run it as their post phase, and CI reruns it to catch -drift. If a theme update changes either file, commit the result. Installs -themselves declare no lifecycle hooks (guarded by `tests/npm-scripts.test.mjs`), -so installs run no root-package code. A plain `npm install` resolves and may -rewrite the lock. +The Docsy-update scripts and `approve:hugo` run it as their post phase, and CI +reruns it to catch drift. If a theme update changes either file, commit the +result. The manifests declare no lifecycle hooks (guarded by +`tests/npm-scripts.test.mjs`), so installs run no root-package code. A plain +`npm install` resolves and may rewrite the lock. ### Install configuration @@ -54,8 +54,10 @@ rewrite the lock. a user-level `ignore-scripts` is set; either runs hugo-extended's installer and needs network access. `npm run install:safe` runs no scripts, so unlike in Docsy's flow it never fails on a missing approval. - - Docsy can set the key because its approval flow re-enables scripts for - hugo-extended alone ([Update Hugo](#update-hugo)). + - Docsy can set the key because its `install:safe` re-enables scripts for + hugo-extended alone, in a rebuild step ([officially supported version][]), + so its CI still evaluates the allowlist; this repo's `install:safe` has no + such step. - With the key set, a lock-synced hugo-extended bump with no approval would arrive with a green `check-links`. @@ -77,21 +79,24 @@ npm run update:docsy:main hugo-extended's installer downloads and executes a binary. Every pinned version has a maintainer approval on record (`allowScripts`), and CI flags a bump -without one: `npm ci` fails. The approval covers the install script only; the -binary self-installs at first use regardless. The two-step flow that keeps the -approval current is [Docsy's][officially supported version]. What differs here: +without one: `npm ci` fails ([Install configuration](#install-configuration) +names the installs that run scripts). The approval covers the install script +only; the binary self-installs at first use regardless. The two-step flow that +keeps the approval current is [Docsy's][officially supported version]. What +differs here: - The version tracks Docsy's [officially supported version][] (a site generated - from this template sets its own). If a security PR bumps it, update to the - version Docsy pins instead, with the command below, then approve. + from this template sets its own). If a security PR bumps it, take the fix + through Docsy instead: once Docsy pins a version carrying it, update to that + version with the command below, then approve. - Update using `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; this repo has no `update:hugo` script. For a release younger than the npm cooldown, add Docsy's [`NPM_CONFIG_MIN_RELEASE_AGE` override][Dependency updates] to that command. -- `npm run approve:hugo` has no audit to re-run and no rebuild step; instead it - ends by regenerating the lockfile and the manifest ([Lockfile and generated - manifest][]). +- `npm run approve:hugo` has no audit to re-run and no rebuild step; instead its + tail regenerates the manifest ([Lockfile and generated manifest][]), and the + `hugo` call in that step self-installs the just-approved binary. ### Develop against a local Docsy diff --git a/renovate.jsonc b/renovate.jsonc index d409d9631e..77d15ce7fe 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -23,7 +23,8 @@ }, { "matchManagers": ["github-actions"], - // Exclude "runs-on" labels: they have no releases to look up. + // Not runner labels (runs-on): they aren't repositories, so a Releases + // lookup has nothing to find. "matchDepTypes": ["action", "workflow"], "overrideDatasource": "github-releases", "branchTopic": "{{{depNameSanitized}}}-{{{newDigest}}}", @@ -37,5 +38,5 @@ "enabled": false, }, ], - // cSpell:ignore gomod hugo fortawesome fontawesome + // cSpell:ignore datasource hugo fortawesome fontawesome } From be74c3c643e4831d703936736f2306f7cdaebe97 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 10:15:24 -0400 Subject: [PATCH 36/39] CONTRIBUTING: four wordings the round-10 reviewers flagged (for the owner's review) - "needs network access": a truism for any install, and implied by "downloads a binary" (two Fable runs) - "(a site generated from this template sets its own)": the aside discriminates nobody in a maintainer-notes section - "hugo-extended is updated manually": Docsy excludes it too; the delta is how the version is chosen, so the bullet says that - "manually, see": the comma splice takes a semicolon --- CONTRIBUTING.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1d147381f6..6d08e52ad0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -14,7 +14,8 @@ requirements, and the action-bump merge checks, see Docsy's [Dependency updates][]. What differs here: - The `gomod` manager is disabled; Docsy is [updated manually](#upgrade-docsy). -- `hugo-extended` is updated manually, see [Update Hugo](#update-hugo). +- `hugo-extended` tracks Docsy's version rather than the latest release; see + [Update Hugo](#update-hugo). - `packages/hugoautogen` is regenerated from the theme, reverting any direct Bootstrap or Font Awesome bump. If a security PR bumps them directly, route the fix through a [Docsy update](#upgrade-docsy). @@ -51,9 +52,9 @@ result. The manifests declare no lifecycle hooks (guarded by [Update Hugo](#update-hugo) runs only on an install that runs scripts, and this repo needs one to exist. - Here, CI's `npm ci` is that install, and so is a plain `npm install` unless - a user-level `ignore-scripts` is set; either runs hugo-extended's installer - and needs network access. `npm run install:safe` runs no scripts, so unlike - in Docsy's flow it never fails on a missing approval. + a user-level `ignore-scripts` is set; either runs hugo-extended's installer. + `npm run install:safe` runs no scripts, so unlike in Docsy's flow it never + fails on a missing approval. - Docsy can set the key because its `install:safe` re-enables scripts for hugo-extended alone, in a rebuild step ([officially supported version][]), so its CI still evaluates the allowlist; this repo's `install:safe` has no @@ -85,10 +86,9 @@ only; the binary self-installs at first use regardless. The two-step flow that keeps the approval current is [Docsy's][officially supported version]. What differs here: -- The version tracks Docsy's [officially supported version][] (a site generated - from this template sets its own). If a security PR bumps it, take the fix - through Docsy instead: once Docsy pins a version carrying it, update to that - version with the command below, then approve. +- The version tracks Docsy's [officially supported version][]. If a security PR + bumps it, take the fix through Docsy instead: once Docsy pins a version + carrying it, update to that version with the command below, then approve. - Update using `npm install --save-dev --save-exact --ignore-scripts hugo-extended@X.Y.Z`; this repo has no `update:hugo` script. For a release younger than the npm From 6cfa65df974e9bd3617962986558aab7fb49463e Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 10:15:37 -0400 Subject: [PATCH 37/39] Install configuration: name the Netlify build as the path that checks no approval (for the owner's review) The site list named CI and plain installs; a Netlify deploy is script-free and then runs hugo, whose wrapper installs the pinned binary unchecked. Docsy's Netlify path is the same, so this is a shared fact stated where the site list is; the acquisition change dissolves it. --- CONTRIBUTING.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6d08e52ad0..b04fe920c0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -61,6 +61,9 @@ result. The manifests declare no lifecycle hooks (guarded by such step. - With the key set, a lock-synced hugo-extended bump with no approval would arrive with a green `check-links`. + - The Netlify build is script-free (`install:safe`) and then runs `hugo`, + whose wrapper self-installs the pinned binary: that path checks no approval + either, here or in Docsy. ### Upgrade Docsy From 7435038e492ba64775f879cc38056e49b1c0d55f Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 10:15:48 -0400 Subject: [PATCH 38/39] Install configuration: Docsy's Netlify path is gated by its rebuild step; only this repo's is not --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index b04fe920c0..44b35d6bd7 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -63,7 +63,7 @@ result. The manifests declare no lifecycle hooks (guarded by arrive with a green `check-links`. - The Netlify build is script-free (`install:safe`) and then runs `hugo`, whose wrapper self-installs the pinned binary: that path checks no approval - either, here or in Docsy. + here (Docsy's does, through its rebuild step). ### Upgrade Docsy From bc216b0091276f3c667ed46e3b8014be69d95653 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 26 Sep 2026 10:21:00 -0400 Subject: [PATCH 39/39] renovate.jsonc: the runner-label comment back to the owner's one-liner, "Not" for "Exclude" --- renovate.jsonc | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/renovate.jsonc b/renovate.jsonc index 77d15ce7fe..54fafa7bab 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -23,8 +23,7 @@ }, { "matchManagers": ["github-actions"], - // Not runner labels (runs-on): they aren't repositories, so a Releases - // lookup has nothing to find. + // Not "runs-on" labels: they have no releases to look up. "matchDepTypes": ["action", "workflow"], "overrideDatasource": "github-releases", "branchTopic": "{{{depNameSanitized}}}-{{{newDigest}}}",