feat: swagger-ui from node_modules

.github/dependabot.yml

@@ -52,6 +52,7 @@ updates:
           - react
           - react-dom
           - react-inlinesvg
+          - swagger-ui-dist
         update-types:
           - minor
           - patch

.github/workflows/dependency-impact.yml

@@ -1,6 +1,6 @@
 name: Dependency impact
 
-# Advisory check for Dependabot npm updates: builds the merge base (A) and the
+# Advisory check for npm updates: builds the merge base (A) and the
 # pull request (B), which differ only in dependencies, and compares the rendered
 # output and key pages in a headless browser. Never a required check.
 on:
@@ -19,8 +19,6 @@ concurrency:
 jobs:
   compare:
     name: Advisory dependency impact
-    # The PR author, not github.actor: a maintainer re-running the job must not skip it.
-    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     timeout-minutes: 45
 

.gitignore

@@ -7,6 +7,7 @@
 
 # Generated files
 .docusaurus
+/generated-static/
 .cache-loader
 
 # Misc

README.md

@@ -59,12 +59,17 @@ This command starts a local development server and opens up a browser window. Ma
 
 ### Static Swagger UI distribution
 
-`/api` serves the static Swagger UI distribution. Its exact source package, Yarn resolution, and
-SHA-256 file hashes are recorded in `static/swagger-ui-vendor.json`. After intentionally changing
-the exact `swagger-ui-dist` development dependency, run `yarn vendor:swagger-ui` and then
-`yarn test:swagger-ui-vendor`. The vendor command updates only the published distribution assets;
-`static/api.html` and `static/swagger-initializer.js` remain Netdata-specific configuration. The
-vendor contract also records the title-only local accessibility overlay on its OAuth redirect page.
+`/api` is the hand-written `static/api.html` page with Netdata's `static/swagger-initializer.js`.
+The Swagger UI files it loads are not committed: `src/plugins/swagger-ui-assets.js` copies them
+from the installed `swagger-ui-dist` package into the ignored `generated-static/swagger-ui/`
+directory on every `yarn start` and `yarn build`, and Docusaurus publishes that directory next to
+`static/`. The served version is therefore always the one locked in `yarn.lock`, and a
+`swagger-ui-dist` update needs no manual step. The build fails if the package stops shipping a
+listed file.
+
+Learn does not publish Swagger UI's `oauth2-redirect.html`, because the Netdata API defines no
+OAuth2 security scheme. If one is added, add `oauth2-redirect.html` and `oauth2-redirect.js` to
+the plugin's asset list; the site build gate requires the page to have a title.
 
 ### Dependency update authority
 
@@ -89,11 +94,11 @@ owned by Docusaurus and Mermaid.
 ### Cloudflare Web Analytics
 
 The shared `docusaurus.config.js` script configuration installs one deferred module beacon on
-each rendered page except the credential-handling `api.html` and `oauth2-redirect.html` artifacts.
+each rendered page except the credential-handling `api.html` artifact.
 Its public site token identifies the existing Cloudflare analytics site. The payload sets
 `send.to` to `/cdn-cgi/rum` so production browser reports use the Learn origin's Cloudflare receiver.
 The build verifier requires exactly that token and destination and rejects additional payload
-fields, duplicate beacons, and third-party code on the credential-handling artifacts.
+fields, duplicate beacons, and third-party code on the credential-handling artifact.
 
 `send.to` is an undocumented option implemented by the unversioned Cloudflare beacon. It is a
 provider compatibility dependency that may change independently of Learn releases. The
@@ -105,8 +110,8 @@ After deployment, verify a production page in a browser: the official beacon mus
 its actual reporting POST to `/cdn-cgi/rum` must complete successfully, and fresh analytics for
 the exact `learn.netdata.cloud` host must appear in Cloudflare. A loaded script, a successful
 OPTIONS request, or a successful POST without fresh provider data is insufficient for full
-recovery acceptance. Test normal documentation and Ask Nedi pages, and confirm that `/api` and
-`/oauth2-redirect.html` still load no third-party analytics.
+recovery acceptance. Test normal documentation and Ask Nedi pages, and confirm that `/api` still
+loads no third-party analytics.
 
 Local servers and Netlify deploy previews do not provide the production Cloudflare receiver at
 `/cdn-cgi/rum`; their failed reporting requests cannot validate production ingestion. Validate

docusaurus.config.js

@@ -1,5 +1,6 @@
 const {themes: prismThemes} = require('prism-react-renderer');
 const {isSitemapIncludedRoute} = require('./seo.config');
+const {SWAGGER_UI_STATIC_DIR} = require('./src/plugins/swagger-ui-assets');
 
 // Extend Dracula with missing token type mappings for YAML, config files, etc.
 const draculaExtended = {
@@ -22,6 +23,7 @@ module.exports = {
 	baseUrl: '/',
 	onBrokenLinks: 'warn',
 	favicon: 'img/favicon-32x32.png',
+	staticDirectories: ['static', SWAGGER_UI_STATIC_DIR],
 	organizationName: 'netdata',
 	projectName: 'netdata',
 	future: {
@@ -182,6 +184,7 @@ module.exports = {
 		// },
 	},
 	plugins: [
+		require.resolve('./src/plugins/swagger-ui-assets'),
 		[
 			"posthog-docusaurus",
 			{

package.json

@@ -19,21 +19,20 @@
 		"docusaurus": "docusaurus",
 		"start": "docusaurus start",
 		"build": "docusaurus build",
-		"build:netlify": "node scripts/verify-git-history.js && node scripts/verify-indexnow-vendor.js && node scripts/verify-swagger-ui-vendor.js && npm ci --prefix scripts/site-build-gate --ignore-scripts --no-audit && docusaurus build && node scripts/run-post-build-gates.mjs",
+		"build:netlify": "node scripts/verify-git-history.js && node scripts/verify-indexnow-vendor.js && npm ci --prefix scripts/site-build-gate --ignore-scripts --no-audit && docusaurus build && node scripts/run-post-build-gates.mjs",
 		"swizzle": "docusaurus swizzle",
 		"deploy": "docusaurus deploy",
 		"clear": "docusaurus clear",
 		"serve": "docusaurus serve",
 		"write-translations": "docusaurus write-translations",
 		"write-heading-ids": "docusaurus write-heading-ids",
 		"test": "vitest",
-		"test:run": "vitest run && npm run test:first-touch && npm run test:indexnow && npm run test:swagger-ui-vendor && npm run test:dependency-authority && npm run test:site-build-gate",
+		"test:run": "vitest run && npm run test:first-touch && npm run test:indexnow && npm run test:swagger-ui-assets && npm run test:dependency-authority && npm run test:site-build-gate",
 		"test:first-touch": "node --test tests/first_touch_capture.test.mjs tests/first_touch_producer_baseline.test.mjs",
 		"test:dependency-authority": "node --test tests/dependency_authority.test.js",
 		"test:indexnow": "node --test tests/indexnow_plugin.test.js",
-		"test:swagger-ui-vendor": "node --test tests/swagger_ui_vendor.test.js",
+		"test:swagger-ui-assets": "node --test tests/swagger_ui_assets.test.js",
 		"test:site-build-gate": "node --test tests/site_build_gate.test.js",
-		"vendor:swagger-ui": "node scripts/verify-swagger-ui-vendor.js --write",
 		"test:coverage": "vitest run --coverage",
 		"test:ui": "vitest --ui"
 	},
@@ -69,7 +68,6 @@
 		"react-player": "^3.4.0",
 		"remark-gfm": "^4.0.1",
 		"saxes": "6.0.0",
-		"swagger-ui": "^5.33.1",
 		"typescript": "^7.0.2",
 		"webpack": "^5.111.1"
 	},

scripts/verify-cloudflare-rum.js

@@ -22,7 +22,7 @@ const REPRESENTATIVE_ROUTES = [
   'docs/collecting-metrics/collectors/index.html',
   'docs/netdata-agent/installation/linux/index.html',
 ];
-const SENSITIVE_ROUTES = ['api.html', 'oauth2-redirect.html'];
+const SENSITIVE_ROUTES = ['api.html'];
 
 function htmlFilesUnder(root) {
   const files = [];