feat: harden OINK platform and version delivery - #472
Open
imbajin wants to merge 61 commits into
Open
Conversation
- reject the repository root and its ancestors as outputs - reject every output path nested inside the active checkout - cover root, parent, and checkout-child deletion attempts
- add five-group docs navigation and explicit sidebar recovery\n- isolate and persist sidebar state by version and locale\n- add click-gated Kapa adapter with strict privacy defaults\n- enable OINK content helpers and branded social fallback\n- cover UI and AI contracts with dependency-free Node tests
- preserve mobile safe-area positioning\n- defer max and env evaluation to browser CSS\n- keep Hugo Sass compilation compatible
- preserve safe-area browser functions through Sass\n- replace unsupported color syntax with rgba values\n- keep responsive status and menu styles buildable
- compile safe-area and translucent styles with Hugo Sass\n- expose sidebar restore only while the tree is collapsed\n- scope backlinks and image zoom to designed surfaces\n- add enabled and invalid AI build fixtures\n- verify CSP, social image, and feature-scope contracts
- add immutable 1.3 and 1.0 refs to the canonical manifest - migrate legacy routes into the five-group information architecture - enforce real hreflang, archive noindex, and sitemap exclusion - support latest-only aggregates and cross-origin staging menus
- enumerate every registered checkout before deleting outputs - reject git-marked candidate paths and ancestors - fail closed when worktree discovery is unavailable - cover sibling and discovery-failure regressions
- enable LLMSFULL only on the English Docs root\n- enable LLMSFULL only on the Chinese Docs root\n- keep other sections and historical content unchanged
- map PR, master, and trusted dispatch events to fixed targets - derive direct Hugo version menus from versions.json - isolate Hugo caches and provision Community render dependencies - separate read-only deploy gates from write-enabled publishing
- add a locked Node 24 Playwright workspace - verify five-version archive and alias contracts in Chromium - assert fixed bilingual Lunr queries rank expected references - keep visual evidence advisory and outside the deploy gate
- generate locale-aware aliases after historical builds - mark every archived page noindex,follow - validate archive robots metadata in artifacts - upgrade Playwright past the browser-download advisory
- fetch every resolved build SHA inside its isolated job - build an AI-enabled fixture from the manifest-derived config - gate shell, AI, Community, ranking, and axe contracts - keep visual captures advisory with the correct theme key
- remove duplicated static version arrays from Hugo config - keep localized menu labels in the stable site config - require generated version config for release entries
- force noindex,follow on regular archive and print pages - retain noindex,nofollow on generated 404 documents - cover both prior robots states in the regression fixture
- add noindex metadata when Hugo alias pages omit robots - preserve dedicated nofollow handling for 404 documents - fail closed when archive HTML has no head or robots marker
- fetch the generated redirect document without browser navigation - assert raw refresh and canonical targets - avoid racing automatic meta refresh in Chromium
- load the metadata query fixture when PR-B is integrated - keep PR-A fallback cases for standalone validation - assert expected routes directly within the top three results
- proxy production-origin artifact requests to the local fixture - stabilize AI tail rendering and shell interaction selectors - validate ranking routes without assuming option markup - keep known upstream axe findings as an explicit baseline
- silence fixture server logs without hiding test failures - persist a non-active top-level sidebar disclosure - resolve expected search titles from the built index - click real palette rows while asserting top-three ranking
- persist sidebar state after OINK completes its disclosure update - wait for asynchronous Lunr results before ranking assertions - remove animation transients from color-contrast scans
- wait for scoped persistence initialization before disclosure clicks - exercise the same non-active Develop group in both locales - scan contrast only after theme and motion styles settle
- select the visible desktop collapse button explicitly - avoid the hidden restore control that shares the data hook - retain the collapse, inert, restore, and focus assertions
- install cwebp and dwebp before source validation - verify both tools are available in the prepare job - keep the Hugo and WebP setup order under a static contract
- cover navigation, search, sidebar, and Community states - pair desktop and mobile routes across light and dark themes - keep all eight screenshots advisory and artifact-backed
- skip Community-only assertions on standalone PR-A artifacts - retain the blocking 5-3-2 and parity contract after PR-B integration - keep shared platform coverage active in both release phases
- skip fixed ranking assertions before PR-B metadata is present - retain native search coverage in standalone PR-A - run all 24 Top-3 cases automatically after integration
- keep historical selectors on the configured production origin - scope generated text corpus URLs for staging validation - reject parent symlinks before resolving removable outputs - cover selector and sentinel regressions
- keep native search retry DOM stable and keyboard usable - reset timed-out Kapa scripts and ignore late callbacks - source Kapa primary colors from the site theme token - limit backlinks to five before native expansion - cover pending, failure, and six-link fixtures
- pass the production historical origin through aggregation - revalidate downloaded artifacts with identical URL scope - cover the aggregate CLI and workflow contract
- group production runs by the asf-site target - isolate staging and pull request concurrency - guard the target-level concurrency contract
- inspect RUNNER_TEMP components before trusting the root - preserve trusted system temporary directory aliases - cover ancestor symlink rejection and real-root cleanup
- keep the first search-index request failure explicit - delegate retries to the local aggregate remapper - avoid accidental dependence on deployed asset hashes
- keep the leading dash inside the argparse value - cover the exact workflow command form - validate the real parser accepts run-scoped suffixes
- generate a deterministic five-version logical route map - scope version choices to equivalent pages or explicit fallbacks - validate map targets and publish an aggregate audit copy - cover aliases, route drift, and missing-target contracts
- route all three version selectors through the page map - preserve query and hash only for equivalent targets - expose a localized one-time fallback status - align Palette execution with native anchor navigation - cover desktop, mobile, and fallback browser behavior
- normalize Hugo permalinks independently of the publish base - preserve logical route lookup for archived EN and CN pages - cover the historical permalink contract with a focused regression
- remove hard-coded runtime version order and refs - bind route generation and validation to the manifest - preserve introduction/readme across historical releases - derive workflow scopes and add browser regressions
- derive missing shared-page destinations from the active site origin - preserve production history selectors for latest-only staging - cover the full-staging 1.0 missing-page regression
- add one manifest-aware server and build wrapper - keep strict production flags and safe argument forwarding - verify generated configuration with isolated command doubles - document the unified bilingual development workflow
- derive native links and Palette choices from one target partial - emit equivalent and fallback flags during Hugo rendering - cover latest and historical bilingual wrapper builds - verify live server Palette navigation preserves page context
- derive the default version from the manifest - reject configuration and strict-build override forms early - keep supported base URL and port semantics aligned - cover negative invocations before either tool can run
- preserve Hugo-authored Palette options during artifact scoping - compare interactive native links with the route oracle - cover postprocess ownership and native drift regressions - exempt print-only outputs without native navigation
- prefer direct targets before consulting equivalence groups - accept exactly one non-null alternate target - preserve fallback behavior for absent or ambiguous routes - cover bilingual latest and historical wrapper output
- derive locale-safe route equivalence groups from reviewed aliases - fail closed on ambiguous route candidates - validate localized LLMSFULL and scoped social images - cover EN/CN selector query and hash preservation
- require aliases to reach a canonical page in the same artifact - resolve validated alias chains to their terminal logical ID - reject malformed equivalence types without traceback - cover missing targets and chained aliases
- inspect every locale-specific Source row - reject cross-origin and cross-version corpus entries - detect malformed and duplicate source metadata
- require canonical locale-bound LLMS source rows - reject ambiguous source URL encodings and delimiters - validate social metadata as same-artifact image targets
- identify alias pages before social metadata validation - exempt redirects only when both social tags are absent - retain strict validation for content and partial metadata - cover redirect, content, and partial-tag regressions
- derive error-document paths from published version metadata - validate 1.3 and 1.0 error pages in security-only mode - fail closed on malformed version metadata - cover complete five-version paths and malicious SEO tags
- require ordinary aliases to remain on the configured origin - enforce current-version scope and existing artifact targets - reuse strict alias checks during route-map generation - reject external, protocol, encoded, and ambiguous targets
- allow only the two reviewed archived home redirects - bind English and Chinese homes to exact shared roots - keep ordinary aliases on strict artifact-local validation - cover production and staging origins plus hostile targets
- reject HTTP aliases whose parsed authority is empty - block whitespace and control characters in redirect targets - cover malformed triple-slash HTTP and HTTPS forms - retain exact archive-home and artifact-local contracts
- reject HTTP(S) URLs without a parsed authority - block whitespace, controls, and backslashes before URL resolution - apply browser-parser shape checks in security-only scans - cover triple-slash, opaque, and control-character forms
- apply one browser-safe shape policy to HTML and CSS tokens - cover srcset, object, media, inline CSS, and stylesheets - run the complete rendered security scan during artifact validation - reject malformed resource URLs in security-only publication gates
- distinguish contact links from executable resource URLs - reject non-HTTP schemes across HTML and CSS resources - preserve explicit mailto and tel anchor behavior - cover script, iframe, object, media, srcset, and CSS inputs
- classify navigation, active resources, and contact URLs by context - reject ping and base while validating form and SVG request targets - cover fetch-capable link relations including prefetch and prerender - allow only passive base64 raster data images - mirror active attributes in version scoping and artifact validation
- tokenize CSS requests and reject ambiguous browser URL surfaces - scope and validate srcset, SVG, and runtime action URLs - externalize Bootstrap data SVGs into versioned local assets - copy shared shell images into every historical build
- distinguish media source requests from picture candidates - mark rendered authored content independently of container nesting - reject premature boundary exits and spoofed markers
- keep media source classification across mismatched end tags - mark ordinary and print-rendered authored content boundaries - cover landing print content without weakening active-markup checks
imbajin
marked this pull request as ready for review
September 5, 2026 00:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Before → after
versions.jsondrives one immutablelatest / 1.7 / 1.5 / 1.3 / 1.0release contract, including selectors, aliases, SEO, and aggregate metadata.Main changes
sidebar state, mobile isolation, focus restoration, theme, image zoom,
Backlinks, and Blog copy-link behavior.
llms-full.txtfiles without adding them tohistorical releases or making Kapa a build dependency.
latest-only staging. A deterministic 195-page route map keeps users on the
equivalent logical page when it exists and gives a locale-correct,
one-time-explained Docs-root fallback when it does not.
short-lived artifacts, aggregate/security validation, Node 24, Playwright,
Chromium, and fixed ASF publication targets.
image attributes, runtime URLs, and authored content boundaries. Bootstrap
control SVGs and shared historical assets remain local and version-complete.
Ask AI direction
The selected design combines a contextual Search Tail with a restrained
Floating Launcher. It excludes a persistent side panel and the old red/pink
assistant treatment.
Full decision record: #467 (comment)
Validation
bash dist/validate-links.shpython3 -m unittest discover -s scripts -p 'test_*.py' -v— 124 passednode --test tests/ui-ai/*.test.cjs— 23 passednode --test tests/e2e/workflow-contract.test.cjs— 6 passed10 error documents; all 195 logical route entries pass exact
forward/missing/reverse validation, including two explicit EN/CN renamed-page
equivalence groups
2 error documents; every historical selector remains on the production
origin
10 error documents; current and historical routes remain on staging
historical LLMSFULL outputs remain absent
version-scoped fallback images present; 59 static redirects are explicitly
distinguished from content pages
retain balanced markers; media nesting and duplicate attributes fail closed
Delivery boundaries
CSP hosts, and live privacy/failure smoke checks pass.