feat: upgrade Hugo to 0.164.0 and replace hardcoded copy with positioning data - #86
feat: upgrade Hugo to 0.164.0 and replace hardcoded copy with positioning data#86trevor-vaughan wants to merge 3 commits into
Conversation
CRAP Load AnalysisNo Go code changes detected in this PR. No CRAP impact. |
|
The repo was pretty far out of date so this turned into a bit of an upgrade refactor to get things up to date. |
84edf1c to
11d688e
Compare
11d688e to
bb43538
Compare
bb43538 to
9d2aee0
Compare
em-redhat
left a comment
em-redhat
left a comment
There was a problem hiding this comment.
This PR bundles a Hugo 0.164.0 upgrade with a positioning data rewrite that addresses #64. The Hugo migration and positioning content are well-executed. However, a compiled Go binary has been accidentally committed and must be removed before merge.
[HIGH] Committed binary file cmd/sync-content/sync-content
A compiled Go binary has been checked into the repository. The .gitignore pattern /sync-content only matches the repo root, not cmd/sync-content/sync-content. Committed binaries are a supply chain risk (opaque content, not reproducible from source, inflates repo size permanently). Remove this file from the commit and update .gitignore to also cover cmd/sync-content/sync-content.
Additional findings:
- [MEDIUM] Broad scope for a single commit — consider splitting Hugo upgrade and content rewrite in future PRs for easier bisection
- [LOW]
assets/jsconfig.jsonmissing trailing newline - [LOW] markdownlint MD013 on
content/docs/getting-started/_index.md:147(504 chars, limit 400) — break the "What does the scan produce?" paragraph into multiple lines - [Pre-existing] gitleaks
generic-api-keyfalse positive in.content-lock.json:3— not caused by this PR; update.gitleaks.tomlto allowlist separately
This review was generated by /review-pr (AI-assisted).
| "url": "https://github.com/complytime/website.git" | ||
| }, | ||
| "scripts": { | ||
| "postinstall": "patch-package --patch-dir patches && ls node_modules/sass-embedded-*/dart-sass/sass >/dev/null 2>&1 && ln -sf \"$(ls -d node_modules/sass-embedded-*/dart-sass/sass | head -1 | sed 's|node_modules/|../|')\" node_modules/.bin/dart-sass || true", |
There was a problem hiding this comment.
[MEDIUM] postinstall script fragility
This one-liner chains patch-package, ls, ln -sf, and sed with || true swallowing all errors. If patch-package fails, the build proceeds silently without patched doks-core templates. If the dart-sass symlink fails, SCSS compilation will break with a hard-to-diagnose error.
Consider separating concerns: let patch-package fail loudly (it's always required), and only suppress errors for the dart-sass symlink (which may be optional on non-Linux platforms):
"postinstall": "patch-package --patch-dir patches && (ls node_modules/sass-embedded-*/dart-sass/sass >/dev/null 2>&1 && ln -sf \"$(ls -d node_modules/sass-embedded-*/dart-sass/sass | head -1 | sed 's|node_modules/|../|')\" node_modules/.bin/dart-sass || true)"
REPOSITORY_GITLEAKS is deprecated in MegaLinter v9.6.0 and will be removed in a future major release. Gitleaks has been superseded by betterleaks, a faster and more accurate secrets scanner by the same author. PR complytime#114 added a .gitleaks.toml with a path allowlist for .content-lock.json, but MegaLinter's gitleaks integration passes its own built-in config via -c /action/lib/.automation/.gitleaks.toml, which overrides local config discovery. The repo's .gitleaks.toml was never loaded — the false positive persisted on every PR that includes the "complyapi" entry (e.g. PR complytime#86 re-run on Jul 30). This commit: - Replaces REPOSITORY_GITLEAKS with REPOSITORY_BETTERLEAKS in .mega-linter.yml - Adds .betterleaks.toml with an Expr prefilter that skips .content-lock.json (commit SHA map, not secrets) - Removes the now-unused .gitleaks.toml Refs complytime#86 Signed-off-by: sonupreetam <spreetam@redhat.com>
Betterleaks scans the full git tree in project mode, unlike file-based linters that respect ADDITIONAL_EXCLUDED_DIRECTORIES. Add node_modules/ to the prefilter to skip vendored dependencies that produce false positives not previously flagged by gitleaks. Refs complytime#86 Signed-off-by: sonupreetam <spreetam@redhat.com>
Bump Hugo from 0.155.1 to 0.164.0 in Dockerfile, CI workflows, and Makefile. Config migrations: - languageCode -> locale, languageName -> label - excludeFiles -> files syntax - caches.getjson -> caches.getresource - site.Data -> hugo.Data in templates - _target -> target in cascade config Infrastructure: - Add sass-embedded with postinstall dart-sass symlink - Patch @thulite/doks-core for SCSS @extend and hugo.Data template fixes - Override doks-core partials (baseof, stylesheet, favicons, opengraph) - Add jsconfig.json for asset path resolution - Add Makefile prerequisite checks for Go, Node, and Hugo versions - Rename CI workflow to Build, add version comments to pinned action refs - Require Node.js >= 22 (was >= 20.11.0) - Remove committed sync-content binary, update .gitignore Assisted-By: Claude Opus 4.6 Signed-off-by: Trevor Vaughan <tvaughan@redhat.com>
Replace hardcoded homepage and getting-started copy with structured data that templates and a new shortcode render from a single source. - Add data/positioning.yaml with problem, audience, maturity, alternatives, and feature card definitions - Rewrite homepage to render feature cards and copy from positioning data instead of hardcoded HTML - Rewrite getting-started to embed positioning sections via shortcode - Add positioning shortcode for embedding sections in docs pages Fixes: #64 Assisted-By: Claude Opus 4.6 Signed-off-by: Trevor Vaughan <tvaughan@redhat.com>
Remove version numbers from CONTRIBUTING.md prerequisites table -- exact requirements are enforced at runtime by Make targets, eliminating the Hugo version drift (0.155.1 vs 0.164.0). Update project structure tree and overrides table to reflect all 16 layout files. Fix devcontainer Dockerfile to install Node 22 via NodeSource instead of Ubuntu apt (which ships Node 18), matching package.json engine requirement. Replace duplicated go vet/gofmt/test steps in both CI workflows with 'make check', making the Makefile the single source of truth for what checks run. Scope clean-nuclear's Hugo cache path to a project-specific variable (HUGO_CACHEDIR) instead of hardcoding /tmp/hugo_cache/. Remove orphaned frameworks section from positioning.yaml that no template consumes. Assisted-By: Claude Opus 4.6 Signed-off-by: Trevor Vaughan <tvaughan@redhat.com>
9d2aee0 to
3202e0e
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| RUN wget -qO- "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - && \ | ||
| apt-get install -y --no-install-recommends nodejs && \ | ||
| rm -rf /var/lib/apt/lists/* |
|
Thanks @em-redhat. I've incorporated your recommended changes (including splitting into multiple commits). I've also added a hook on my end to make sure I don't push binaries that aren't in LFS again 😮💨 Went ahead and did a full |
3 participants
Hugo 0.164 required migrating deprecated config keys and template APIs.
Hardcoded homepage and getting-started copy was replaced with structured
data that templates and a new shortcode render from a single source.
languageCode->locale,languageName->label,excludeFiles->filessyntax,caches.getjson->caches.getresource,site.Data->hugo.Dataand feature card definitions
@extendandhugo.Datatemplate fixesFixes: #64
Signed-off-by: Trevor Vaughan tvaughan@redhat.com