refactor: rename marketplace/mp identifiers to kb - #79
Conversation
|
CI status: every job passes except Four new advisories landed against
|
|
Folded the audit fix into this PR (e23e36e), replacing my note above.
Three advisories remain against Worth flagging separately: |
The project was once "docs marketplace". The name was gone from the UI but
still prefixed every identifier in the contract and the codebase, where it
collided with unrelated projects.
data-mp-headless -> data-kb-headless
.mp-* / #mp-* -> .kb-* / #kb-*
MP_HEADLESS -> KB_HEADLESS
src/styles/marketplace.css -> src/styles/knowledge-base.css
"marketplace" in prose -> "knowledge base"
Hard cut, no compatibility shim: nothing is in production, and the only
producer of single-page HTML is this repo's own action. A stale artifact is
still diagnosable — fetch-apps.js now distinguishes "carries the pre-rename
marker" from "not headless at all" and says which, so a publisher is sent to
the contract rather than to their build script.
Two things deliberately left alone:
* marketplace.json and marketplaceVersion. Both are artifact wire format,
and #74 replaces them with a differently shaped kb-docs.json. Renaming
them here would mean regenerating every fixture twice and would leave the
new name briefly meaning the old shape.
* The example repo's own class names and theme key inside the vendored
tarball. Only data-mp-headless is rewritten in there, because that
attribute is the contract; the rest belongs to that repo and moves with
its own migration.
Also corrects a contract line that told apps to expect a --mp-chrome-h offset
variable. Nothing has injected it since the fixed chrome bar was removed, so
renaming it would have invented a variable rather than documented one.
Fixtures regenerated: the single-page bundle from setup-test-apps.mjs, and
the docs-example tarball repacked with an identical member list.
Suites green: 85 embedded, 22 standalone, action self-test 18.
Closes #77
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PYtmxSeSXFg4wEXRcKCmAi
Four high-severity advisories landed against fast-uri, which reaches the production tree as a transitive dependency of ajv: GHSA-5jgf-p345-68v8 host confusion via skipped IDN canonicalization GHSA-f65p-4m7j-42xc SSRF via malformed IPv6 normalization GHSA-fph4-wmhf-6fwf SSRF via repeated hostname percent-decoding GHSA-jqff-g426-hqxp host confusion via percent-encoded scheme normalization All four are patched in 3.1.6. ajv@8.20.0 asks for ^3.0.1, so the newest 3.x satisfies it and this is a lockfile-only change — package.json is untouched and no dependency is added, removed or re-ranged. `npm audit --omit=dev --audit-level=high`, which is exactly what CI runs, now reports 0 vulnerabilities and exits 0. Three advisories remain against js-yaml, nanoid and qs. All three are dev-only (`npm ls` with --omit=dev resolves none of them), so they never reach a deployed image and are outside the gate, which is prod-only by design. Left alone rather than churning the toolchain lockfile in a rename PR. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PYtmxSeSXFg4wEXRcKCmAi
The pull_request trigger filtered on `branches: [master, main]`, so a stacked PR got no checks at all except the bottom layer. Every branch above it — the contract, the registry refactor, the actions — merged into its parent without a build, a test run or an image scan, and the first CI those changes saw was after the whole stack had already landed. Push still filters to master/main: that trigger exists to test the trunk, and a push to a stack branch is already covered by its PR. Part of #73. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PYtmxSeSXFg4wEXRcKCmAi
e23e36e to
95b8ec9
Compare
`allowed-target-branches: master` failed every layer of a stacked PR except the bottom one: a stack layer targets the layer below it, which is by construction not master. The check exists to stop a PR aimed at some unrelated branch, and it can still do that — the base branch is now allowed as well, but only when it is itself a convention-named branch matching the same pattern the branch-name check enforces. Also drops the base-branch filter from the trigger, to match ci.yml. GitHub runs the workflow for every layer of a registered stack regardless, so the filter described an intent the platform was not honouring. Part of #73. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PYtmxSeSXFg4wEXRcKCmAi
1 participant
Closes #77. First of the pre-production contract changes tracked in #73, done first and on its own so the behavioural work in #74 and #75 lands as a readable diff instead of drowning in rename churn.
What changed
data-mp-headlessdata-kb-headless.mp-*/#mp-*(doc, masthead, card, tag, code, anchor, chrome, single-page).kb-*/#kb-*MP_HEADLESSKB_HEADLESSsrc/styles/marketplace.csssrc/styles/knowledge-base.cssmarketplaceCssHrefkbCssHrefHard cut, no compatibility shim, as the issue specifies: nothing is in production, and the only producer of single-page HTML is this repo's own action.
A stale artifact is still diagnosable rather than silently mis-read.
scripts/fetch-apps.jsnow distinguishes the two failure modes it used to collapse into one warning:data-mp-headless→ "produced against the pre-rename contract, republish with a current action"--headless"Deliberately not renamed
marketplace.jsonandmarketplaceVersion. Both are artifact wire format, and #74 replaces them with a differently shapedkb-docs.json(kbVersion+apps[]). Renaming them here would regenerate every fixture twice and leave the new name briefly meaning the old shape. Sogit grep -i marketplaceis not empty yet — it returns only those two tokens (47 + 14 occurrences), and emptying it is a #74 done-criterion. Flagged on the issue.The example repo's own identifiers inside the vendored tarball. Only
data-mp-headlessis rewritten in there, because that attribute is the contract between the artifact and this repo. Its class names and theme key belong toknowledge-base-docs-exampleand move in AbsaOSS/knowledge-base-docs-example#3.Two things found on the way
A contract line documenting a variable that does not exist.
HEADLESS_RULES.mdtold apps their sidebar offset would be reset tovar(--mp-chrome-h)"via injected CSS". Nothing has defined or injected that variable since the fixed chrome bar was removed — it appears in no source file, only in that sentence. Renaming it would have invented a variable rather than documented one, so the row now says what actually happens: nothing is reserved above the content. The theme-toggle row lost a dangling reference to the same removed chrome.The vendored fixture is not marked headless at all. Its HTML is plain
<html lang="en">; the only occurrence of the marker in the whole tarball was an attribute selector indist/docs/style.css. That selector is rewritten so the rule still fires against whatBase.astronow emits. Worth knowing: no test covers the fetch-time marker check, becauseprebuiltartifacts never reach it. That gap closes in #75, which puts every source on one install path.Fixtures
tests/fixtures/single-page-bundle/regenerated fromscripts/setup-test-apps.mjs(it renders through the action'stemplate.js, so the fixture cannot drift from real output).tests/fixtures/docs-example.dist.tar.gzextracted, marker rewritten, repacked with--sort=nameand a fixed mtime. Member list verified byte-for-byte identical to the original.Verification
npm test(embedded web-fragment harness)playwright.config.ci.js(standalone fragment server)publish-single-page-docsself-testnpm run build:headlessNot run locally:
test:container(needs Docker) — CI's image job covers it.nginx.confandDockerfileturned out to need no change; neither mentioned the old name.🤖 Generated with Claude Code
https://claude.ai/code/session_01PYtmxSeSXFg4wEXRcKCmAi