Fix formatting in resume file - #1961
Closed
carrascomalany42-lgtm wants to merge 218 commits into
Closed
carrascomalany42-lgtm wants to merge 218 commits into
carrascomalany42-lgtm wants to merge 218 commits into
Conversation
This warning is older than the Sourcegraph repo
closes PLAT-22 extra warnings for deprecation of kustomize deployment type
closes PLAT-412 closes PLAT-413 This PR adds a deprecation and sunset warning for the AMIs and k3s install script deployment types
closes PLAT-415 This PR adds a sunset warning to the docs repo that single-container will be sunset in the 7.0.0 release.
This is just a note that we plan to deprecate the pure docker deployment type
closes PLAT-414 Corresponding docs update to sourcegraph/sourcegraph#9099 Warns admins that the automatic PG upgrade entryscript is removed in 7.0.0
- highlight scip-go-action usage - document manual indexing steps for other CI systems and local indexing - initial, standardized, layout for scip indexer docs
This PR updates the own documentation to reflect the new behavior of this feature. --------- Co-authored-by: Erik Seliger <erikseliger@me.com>
…ourcegraph#1583) Add documentation for env var added in: - sourcegraph/sourcegraph#9509
[context](https://sourcegraph.slack.com/archives/C05MW2TMYAV/p1771922078724959) * Document deepsearch tool --------- Co-authored-by: Jan Hartman <janhartman@users.noreply.github.com>
…#1636) This was using the <sub> HTML tag which caused some issues with layout. These are better shown as callouts. <img width="1482" height="1106" alt="CleanShot 2026-02-24 at 11 27 35@2x" src="https://github.com/user-attachments/assets/b19aca23-a8f8-428f-b18f-bbd784c22ff5" />
…graph#1640) Not sure why this section was called on-premises, isnt everything else also on-premises?
…43) (sourcegraph#1639) This is an automated pull request, created by //doc:generated.push on sourcegraph/sourcegraph Co-authored-by: Buildkite <buildkite@sourcegraph.com>
- Makes the `/api` page the landing page for the new external API - Add warning on GraphQL API page, rebrand as a debug API - Removes a lot of GraphQL examples pages to start discouraging their use and also clean things up
Will merge once 7.0 is released everywhere
- Remove experimental callout - MCP is now generally available - DCR is now enabled by default, update docs accordingly - Add new 'mcp' scope documentation for OAuth and access tokens - Add 'Disabling DCR' section for admins who need to turn it off - Add upgrade notes for users migrating from 7.0 - Update mcp-remote example to use 'mcp' scope instead of 'user:all' --------- Co-authored-by: Amp <amp@ampcode.com>
Customer is asking for it and in hindsight, better to have it and add a big warning than delete it so fast, oops
had amp run through all the 7.0 mentions and link them
Updates the permissions reference table to include three new scopes (assistant:write, files:read, reactions:write) that are present in the current app manifest but were missing from the documentation.
…19) (sourcegraph#1654) This is an automated pull request, created by //doc:generated.push on sourcegraph/sourcegraph --------- Co-authored-by: Buildkite <buildkite@sourcegraph.com> Co-authored-by: Robert Lin <robert@bobheadxi.dev>
…04) (sourcegraph#1656) This is an automated pull request, created by //doc:generated.push on sourcegraph/sourcegraph Co-authored-by: Buildkite <buildkite@sourcegraph.com>
Part of https://linear.app/sourcegraph/issue/SVC-2147/v2t-better-advertise-export-privacy-guarantees Will add sourcegraph/sourcegraph#10419 in the future as well once that is live
Updates the permissions reference table to include the new scope we added in sourcegraph/sourcegraph#10458
CLOSE CU-2424 Adds a new guide that walks integrators through migrating to the new Sourcegraph API ## Testing http://localhost:3000/deep-search/api --------- Co-authored-by: Robert Lin <robert@bobheadxi.dev>
… for AI-assisted Deep Search API migration (sourcegraph#1666) Adds a copy-pasteable prompt to the AI-assisted migration section of the Deep Search API docs. Fix the heading level problem in the guide. <img width="288" height="275" alt="Screenshot 2026-03-02 at 4 16 51 PM" src="https://github.com/user-attachments/assets/b37c595d-8151-45c6-8f52-99886aae5be7" /> <img width="548" height="479" alt="Screenshot 2026-03-02 at 4 16 55 PM" src="https://github.com/user-attachments/assets/0773eeb8-5e83-4f92-95c4-a1d9e5cc7ae1" />
## What The 404 page only offered "Go back home". It now also shows, when applicable: - **Go back to `<path>`** — the docs page the user was on before this one - **Go up to `<path>`** — the closest ancestor of the requested URL that is a real docs page (preview pages excluded). Omitted when that ancestor is the root (the home link covers it) or is the same page as the back link. ## Before - Only see a clickable link to the home page, which is almost never where I want to go <img width="551" height="362" alt="image" src="https://github.com/user-attachments/assets/b14f9ac8-ba90-4234-9203-bbacc4c96a57" /> ## After - Also see a link back to the previous page I was on - If there's also a valid parent page, which is different than the previous page, then show that as an option as well (useful because we have so many broken links / redirects to old subpages, and the content's likely been moved to the parent page, or another page I can click to from the parent page) <img width="1268" height="605" alt="image" src="https://github.com/user-attachments/assets/a0c16b6e-7d8e-477a-907e-3bab297f6dc9" /> --------- Co-authored-by: Amp <amp@ampcode.com>
Sourcegraph replaced \`inconshreveable/log15\` with [sourcegraph/log](https://github.com/sourcegraph/log) years ago, so nothing prints \`lvl=eror\` anymore. Three docs still show it. - **\`self-hosted/observability/logs.mdx\`**: list the canonical \`SRC_LOG_LEVEL\` values (\`debug\`, \`info\`, \`warn\`, \`error\`, \`none\`) per [levels.go](https://github.com/sourcegraph/log/blob/main/levels.go), and note that unknown values fall back to \`warn\`. The legacy \`dbug\`/\`eror\`/\`crit\` spellings are still accepted by the code but are no longer documented. - **\`self-hosted/observability/troubleshooting.mdx\`**: drop the 2020 log15 sample line. The \`syncer.sync.store.upsert-repos\` error string no longer exists either; keep the scenario and describe the \`driver: bad connection\` symptom in prose. - **\`admin/auth/index.mdx\`**: the \`Invalid Authorization header\` log15 error is gone. Per [\`cmd/frontend/internal/auth/accesstoken/auth.go\`](https://github.com/sourcegraph/sourcegraph/blob/main/cmd/frontend/internal/auth/accesstoken/auth.go), an unrecognized \`Authorization\` scheme is now ignored and recorded as an \`auth.accessToken\` / \`failed\` audit log entry with \`reason: "invalid Authorization header"\`. ## Amp threads - [Cspell word list review](https://ampcode.com/threads/T-01a082f4-e864-769b-8269-46847abcd228) --------- Co-authored-by: Amp <amp@ampcode.com>
Linear [FE-499: Fix doc site issues](https://linear.app/sourcegraph/issue/FE-499/fix-doc-site-issues) ## Problem - Our docs site has hundreds of broken links - `dev/check-links.mjs` finds broken internal links and anchors, but it isn't run automatically, so PRs can easily break links (renaming a heading, moving or deleting a page) without anyone noticing ## Solution - Updated the script to also work as a PR check, with additional functions beyond what's run when used as a CI test in Vercel builds - PR check to run the script and report if the PR breaks links - It runs the script (with `--check-anchors`) on both the PR head and its merge base, and diffs the findings - This catches both directions: - **Outbound**: a changed page links to a page or `#heading` that doesn't exist - **Inbound**: the PR renames a heading or removes/moves a page that other, unchanged pages link to — those show up as findings in files the PR didn't touch - Pre-existing broken links are ignored by the PR check - The comment is created / updated in place, and once the PR is fixed, the PR check passes and the comment is updated to say so - A PR that never broke anything gets no comment ## Verification PR check comment in test PR: sourcegraph#1895 (comment) ### Broken links found <img width="1826" height="1628" alt="Screenshot 2026-09-09 at 20 05 31" src="https://github.com/user-attachments/assets/930cde1f-50b1-46c0-9421-bd75a257c17d" /> ### Broken links fixed <img width="910" height="168" alt="Screenshot 2026-09-09 at 20 06 31" src="https://github.com/user-attachments/assets/1cc26276-5cba-4595-85fc-8e10955aabab" /> ## Absolute self-links and external links - Absolute links to this site (`https://sourcegraph.com/docs/…`, `http://…`, `//…`, `www.`, the legacy `https://docs.sourcegraph.com/…`) fail the check even when the target exists: they leave the Vercel preview and local dev, and hide moved pages behind redirects. The finding names the relative link, following `src/data/redirects.ts` when the page moved. Version-pinned links (`/@5.1/…`) stay external - External links on lines this PR added are requested (HEAD, then GET on an error status, following redirects); only 404 and 410 are findings, so rate limits, bot blocks, 5xx and network errors never fail a PR. Placeholder hosts (`*.example.com`, `localhost`, templated `<host>`) are skipped - Findings with a fix become one suggested-change review comment per line, which the author can apply from the PR. Suggestions already on the PR are not posted again - sourcegraph#1899 clears the 67 existing absolute self-links so this check starts from zero Test PR: sourcegraph#1900 (report comment + one review suggestion; the `#sampling` anchor deliberately does not exist, so that link gets no suggestion; a second run posted nothing new) ## Related - Draft PR sourcegraph#1562 proposes a daily Slack digest with a separate reimplementation of this script - Instead, this PR improves on the existing script, and gates PRs - PR sourcegraph#1860 enabled external link checkers to find broken links again ## Amp threads - [Broken link PR check](https://ampcode.com/threads/T-01a0753f-0f4f-7478-b36c-87466e7c0261) - [Asset case mismatch](https://ampcode.com/threads/T-01a07597-43c0-751b-8c49-6e5809e714d2) - [Docs - Fix broken heading links](https://ampcode.com/threads/T-01a07623-9d65-7356-96b8-2bebb31ffa5a) - [Self-links and external links](https://ampcode.com/threads/T-01a08a01-44c1-775b-84d0-d67ff9501905) --------- Co-authored-by: Amp <amp@ampcode.com>
…sourcegraph#1899) ## What Rewrites every link to this site that was written as an absolute URL (`https://sourcegraph.com/docs/…`, `http://sourcegraph.com/docs/…`, `https://docs.sourcegraph.com/…`) as a relative link (`/admin/config/site-config`), in 15 files. - 32 pointed at the current route: prefix dropped. - 31 pointed at a moved page and only worked through `src/data/redirects.ts`: now link straight to the destination. - 4 needed a hand fix: the `commands#commands-id-mode` and `features#shard-merging` anchors no longer exist, `github#github-com-rate-limits` became `#rate-limits`, and the deleted gRPC guide now links to its archived 5.3 page. ## Why Absolute links leave the Vercel preview and the local dev server, and hide moved pages behind redirects. sourcegraph#1858 makes `dev/check-links.mjs` fail PRs that add them; this PR clears the backlog so that check starts from zero. ## Verification `node dev/check-links.mjs --check-anchors --root <this branch>` with the checker from sourcegraph#1858: 0 absolute self-links left, and no new findings against `main` (317 → 250 pre-existing findings; the 67 removed are all self-links). ## Notes for reviewers - Bare URLs in prose and code blocks (e.g. the `See https://docs.sourcegraph.com/admin/observability/tracing` cells in `docs/cli/references/*`) are not links and are untouched; sourcegraph#1851 covers those. - `docs/admin/repo/perforce.mdx`, `docs/self-hosted/observability/alerts.mdx` and `dashboards.mdx` are synced from sourcegraph/sourcegraph (sourcegraph#1883); the same links need the same fix upstream or the next sync reverts them. - `docs/technical-changelog.mdx` holds 31 of the links and is retired by sourcegraph#1888; if that lands first, take the deletion. Co-authored-by: Amp <amp@ampcode.com>
…egraph#1898) `pnpm audit` on `main`: **184 advisories** (4 critical, 71 high). After this PR: **40** (2 critical, 17 high), all of which are pinned by `next` 14 or `contentlayer` 0.3.4. ## Changes - **Remove `baseai` / `@baseai/core`**, the `baseai/` memory config, `docs-chatbot.md`, and the `pnpm sync` script. The Langbase chatbot was replaced by runLLM and nothing imports these. They alone pulled in `hono` (34 advisories), `tar` (12, incl. 1 critical), `xlsx` (2 high, no fix available), `form-data`, `yaml`, `uuid`, and most of the `minimatch` / `brace-expansion` hits. - **Remove `js-yaml`** from direct dependencies: never imported by `src/` or `dev/`. - **`mermaid` 11.12 → 11.16**: carries the `dompurify` XSS fixes, the only vulnerable code that actually ships to visitors' browsers. - **`sharp` 0.32 → 0.35** (devDep, build only): libvips / libheif CVEs. - Re-resolve vulnerable transitives within their existing semver ranges (`minimatch`, `brace-expansion`, `picomatch`, `nanoid`, `protobufjs`, `@grpc/grpc-js`, ...). Lockfile loses ~2,000 lines. - `.gitignore`: add `/logs` for script output, drop the stale `**/.baseai/` entry. ## Verification - Clicked through Vercel preview, checked Mermaid diagrams, search, nav menu, it all works With `node 20.20` / `pnpm 10.25` (per `.tool-versions`): - `npx tsc --noEmit` clean, `pnpm lint` clean - `pnpm build`: 521 documents, 526 static pages, `dev/check-links` / `check-filenames` / `check-images` / `generate-mermaid-icons` all pass; route table unchanged - Both pages with Mermaid diagrams (`admin/architecture`, `self-hosted/sourcegraph-nginx-mermaid`) render correctly under `next start` in headless Chrome - `pnpm why baseai hono tar xlsx` → not found; `rg baseai` → only the AGENTS.md history note --------- Co-authored-by: Amp <amp@ampcode.com>
Linear [FE-499: Fix doc site issues](https://linear.app/sourcegraph/issue/FE-499/fix-doc-site-issues) ## Summary - Install CSpell 10 in CI only (not a project dependency); `npx cspell@10 --no-progress --dot '**/*'` runs the full-repository check locally - Add a custom dictionary file to allowlist needed words - On pull requests, report only spelling errors on lines added by the PR, so existing repository findings are ignored - Create / update one PR summary comment containing grouped file, line, column, word, and context details, plus an inline review comment per flagged line with a one-click GitHub suggestion for the best candidate - Every comment links to `cspell-allow-list.txt` on the PR branch, to allowlist false positives - Resolve the comment after fixes - Initially roll out the PR check as non-blocking, while preserving the local command's failing exit code ## Verification - Simulated an added typo: the diff checker exited 1 and reported exactly that word, line, column, and context - Reverted the typo: the diff checker exited 0 despite pre-existing repository findings - Prettier checks passed for the script, package/config, and workflow - Workflow YAML parsed successfully and every shell `run` block passed `bash -n` - `node --check dev/check-spelling.mjs` - `git diff --check` ## Exclusions - CSpell honors `.gitignore`, so dependency, cache, and build output remain excluded - The full local check additionally skips: - Binary image/font formats - `pnpm-lock.yaml` - CSpell's own config/dictionary - Checked-in generated outputs (`docs/technical-changelog.mdx`, generated observability alert/dashboard references, and the generated AWS icon module) ## Screenshots From demo PRs sourcegraph#1892 and sourcegraph#1893: Summary comment  Inline review comment  ## Amp threads - [Spelling PR check](https://ampcode.com/threads/T-01a06e27-8097-7461-8d90-eef25db09feb) - [CSpell PR check](https://ampcode.com/threads/T-01a06e21-70c8-77bb-aa01-9a6fa75488bd) - [Inline spelling comments](https://ampcode.com/threads/T-01a0837b-04dc-7559-831d-ba3b35c75489) - [Clean cspell dictionary](https://ampcode.com/threads/T-01a07e67-73b3-779f-8880-7ba770fe7ade) - [Cspell word list review](https://ampcode.com/threads/T-01a082f4-e864-769b-8269-46847abcd228) - [Link to allow list in comments](https://ampcode.com/threads/T-01a085a6-bee2-73a7-a3d4-49683789fc84) --------- Co-authored-by: Amp <amp@ampcode.com>
sourcegraph#1873) Linear [FE-499: Fix doc site issues](https://linear.app/sourcegraph/issue/FE-499/fix-doc-site-issues) ## Summary Follow-up to sourcegraph#1855. While reviewing the ~1100-word dictionary in sourcegraph#1853 for misspellings, these five were the only ones still present in non-generated docs: - `$LINTER_ERRROS` → `$LINTER_ERRORS` in the batch spec templating example (the step's `env` defines `LINTER_ERRORS`, so the example was referencing an unset variable) - `gorelaserConfig` → `goreleaserConfig` - ````sguqery` → ````sgquery` code fence language (2 occurrences) - `lobal` → `Global` in an image alt text - `imedout` → `timedout` in the `src search -get-curl` GraphQL example (moved here from sourcegraph#1853) All other misspellings in the dictionary were either already fixed by sourcegraph#1855 or appear only in generated files that CSpell ignores (`docs/technical-changelog.mdx`, observability alerts/dashboards). Also moved from sourcegraph#1853: seven example placeholders that CSpell flagged as gibberish (a fake commit hash, tmp filename, pod name, TLS cert blobs, an ARN, and base64 IDs), replaced with realistic-looking placeholders that pass the check. sourcegraph#1853 will drop these words from `cspell-allow-list.txt`. ## Verification - `git diff --check` - `rg` for each fixed word returns no hits outside generated files ## Amp threads - [Clean cspell dictionary](https://ampcode.com/threads/T-01a07e67-73b3-779f-8880-7ba770fe7ade) --------- Co-authored-by: Amp <amp@ampcode.com>
…ourcegraph#1885) ## Summary Brings `docs/self-hosted/updates/migrator/schema-drift.mdx` in line with what `migrator` prints today (`internal/database/migration/drift/` and `lib/output/emoji.go` in sourcegraph/sourcegraph). **Removed** the `lsif_data_docs_search_private_delete` example: - The drift it shows cannot be reported anymore. Since sourcegraph/sourcegraph@f9b273e (#51237, May 2023) `normalizeFunction` collapses all whitespace in function definitions before comparison, so a space-vs-newline difference is no longer drift. - Its pasted `cmp.Diff` output was hard-wrapped mid-token (`$functio"` / `"n$`), which is also what produced the `functio` fragment in the spellcheck word list. **Refreshed** the remaining examples: - `EmojiFailure` is now ` ⨯` (was `❌`); the migrator banner uses `✱`. - Column drift with a targeted fix says `Suggested action: alter the column.` and prints only the `ALTER` statement, no go-cmp struct diff (`compare_columns.go` + `ColumnDescription.AlterToTarget`). The old `change the column nullability constraint` and `replace the function definition` wordings were dropped in sourcegraph/sourcegraph@5fbbcda (#50207). - The drift command prints one ` ⨯ Drift detected!` preamble before the summaries (`drift/util.go`). - The upgrade-time hint now ends with the docs link migrator actually prints (`multiversion/drift.go`). - Unwrapped the hard-wrapped SQL so statements match migrator output. ## Test plan - Compared each line against the current source files named above. - Page reads cleanly: the "Then check the database again..." paragraph flows straight into the support / `-skip-drift-check` paragraph. ## Amp threads - [Drop old migrator example](https://ampcode.com/threads/T-01a08426-e0ec-71d9-a4b9-bcf3deaa2890) --------- Co-authored-by: Amp <amp@ampcode.com>
…1886) ## Why The docs sync from `sourcegraph/sourcegraph` ([`doc/_generated.push.sh`](https://github.com/sourcegraph/sourcegraph/blob/main/doc/_generated.push.sh)) does `cp -R -L doc/cli/** _clone/docs/cli/` — it only adds and updates pages, never deletes. So when a command is removed from src-cli, its reference page lingers here forever. Replaying the sync against `main` shows zero drift in the 62 generated pages, but 36 files under `docs/cli/references/` are never written by it. This PR deletes the 28 that are stale. No redirects are added; none of these pages are linked from anywhere in the site. ## Removed (28 files) **Command removed from src-cli** | Pages | Removal | |---|---| | `extensions/{index,copy,delete,get,list,publish}` | sourcegraph/src-cli#1173 (extensions platform sunset) | | `lsif` | sourcegraph/src-cli#1147 (→ `src code-intel upload`) | | `scout` | sourcegraph/src-cli#1196 | | `sbom`, `signature` | sourcegraph/src-cli#1273 (SBOMs/signatures no longer published as of 7.0.2852; the how-tos already carry deprecation notices) | | `admin` | sourcegraph/src-cli#1309 (built for the appliance, which never launched) | | `validate` | sourcegraph/src-cli#1310 | **Command never shipped** `prompts` + 13 subcommand pages (sourcegraph#1155) documented sourcegraph/src-cli#1168, which was closed unmerged. **Stale duplicates shadowing generated pages** `auth.mdx` and `codeowners.mdx` collide with `auth/index.mdx` / `codeowners/index.mdx`: contentlayer flattens both to `cli/references/auth`, and `allPosts.find` returned the stale flat file. After this change `/cli/references/auth` and `/cli/references/codeowners` render the generated group pages (verified with `contentlayer build`). ## Kept `search-jobs/{cancel,create,delete,get,list,logs,restart,results}` — the subcommands exist, but `src doc` only emits a single `search-jobs.md` because `searchJobsCommands` isn't in the `commanders` map in [`cmd/src/doc.go`](https://github.com/sourcegraph/src-cli/blob/main/cmd/src/doc.go#L59-L66). Fix belongs upstream. ## Verification - `npx tsc --noEmit` passes - `npx contentlayer build` generates 493 docs; `cli/references/auth` and `cli/references/codeowners` now resolve to the `index.mdx` files - No remaining links to the deleted slugs anywhere in `docs/` or `src/` ## Follow-up (upstream) To stop this recurring, `_generated.push.sh` should mirror `docs/cli/references/` (delete-then-copy) instead of copying over it. Done in sourcegraph/sourcegraph#15529 (merge after sourcegraph/sourcegraph#15528 and sourcegraph#1889). ## Amp threads - [Stale command docs](https://ampcode.com/threads/T-01a08410-86ca-72be-9928-2810e837fae1) Co-authored-by: Amp <amp@ampcode.com>
Part of [FE-502](https://linear.app/sourcegraph/issue/FE-502). **Step 4 of 4** in a cross-repo stack, but **mergeable now** — it pre-seeds what the generated-docs sync will eventually write, so the live reference gets fixed without waiting on a src-cli release. ## Why The `src` CLI reference is generated by `src doc` and synced here by sourcegraph/sourcegraph's `sync/generated-docs` job. Two generator bugs (fixed in sourcegraph/src-cli#1375) left this reference incomplete: - `search-jobs`, `debug` and `snapshot` were never registered in the generator's `commanders` map, so each is a single page with only the group help; their 16 subcommands have no reference pages. (The 8 `search-jobs/*.mdx` pages here were hand-written by Travis Lyons in May 2025 to paper over this; nothing links to them.) - `index.mdx` lists only the 8 urfave/cli commands (`abc`, `api`, `auth`, `codeowners`, `login`, `orgs`, `users`, `version`) — `batch`, `repos`, `search`, `config`, etc. are missing from https://sourcegraph.com/docs/cli/references today. ## What - `index.mdx`: lists all 19 top-level commands. - `debug/{index,compose,kube,server}.mdx`, `snapshot/{index,databases,restore,summary,test,upload}.mdx`: new. - `search-jobs/index.mdx`: new; `search-jobs/{cancel,create,delete,get,list,logs,restart,results}.mdx`: hand-written pages replaced by generated ones (same usage text, plus a flags table; the `<p className="subtitle">` blurbs go away since the generator doesn't emit them). - Deleted `debug.mdx`, `search-jobs.mdx`, `snapshot.mdx`. - Deleted `teams.mdx` and dropped `teams` from `index.mdx`: teams were removed in Sourcegraph 7.0 and sourcegraph/src-cli#1376 removes the command, so the generator no longer emits this page. No redirect (same call as sourcegraph#1886). The sync job never deletes files, and in contentlayer routing a flat `foo.mdx` shadows `foo/index.mdx` (the same bug sourcegraph#1886 fixed for `auth.mdx`/`codeowners.mdx`), so these have to go by hand for the new index pages to be reachable. Content was produced by running the patched generator (src-cli `main` + sourcegraph#1375) and the same `tools/md2mdx` conversion the sync uses, so the sync PR that follows sourcegraph/sourcegraph#15528 should be a no-op for these paths. No redirects: the three deleted URLs (`/cli/references/{debug,search-jobs,snapshot}`) keep resolving, now to the new index pages. ## Stack 1. sourcegraph/src-cli#1375 — generator fix + tests; sourcegraph/src-cli#1376 (stacked) — remove `src teams`; sourcegraph/src-cli#1377 (stacked) — `src help` generated from registered commands, tests help == docs 2. src-cli 7.7.0 release (none since 7.6.0; blocks 3) 3. sourcegraph/sourcegraph#15528 — pin bump + `OUTPUT_FILES` + regenerate (draft until 2) 4. **this PR** 5. sourcegraph/sourcegraph#15529 — make the docs sync mirror `docs/cli/references/` so removed commands disappear automatically (merge after 3 and this PR) Related: sourcegraph#1886 (removed 28 stale pages for commands that no longer exist). ## Test plan `npx contentlayer build` → 528 documents; routes resolve to the intended files: ``` /cli/references/debug <- cli/references/debug/index.mdx /cli/references/search-jobs <- cli/references/search-jobs/index.mdx /cli/references/snapshot <- cli/references/snapshot/index.mdx ``` plus the 16 subcommand routes. (The `ERR_INVALID_ARG_TYPE`/clipanion stack trace during the build is pre-existing on `main`.) ## Amp threads - [Stale command docs](https://ampcode.com/threads/T-01a08410-86ca-72be-9928-2810e837fae1) --------- Co-authored-by: Amp <amp@ampcode.com>
…orted dictionary entries (sourcegraph#1917)
Follow-up to sourcegraph#1887, found while smoke-testing production after today's merges. ## Problem On production the 404 page's "Go back to" link (built from `document.referrer`) rendered as **Go back to /docs/cli** with href **/docs/docs/cli**. `document.referrer` keeps the `/docs` basePath and `next/link` adds it again. The same code would also link a same-origin non-docs referrer (`sourcegraph.com/pricing`) into the docs. Vercel previews serve at the root with an empty basePath, so sourcegraph#1887's preview could not show this. ## Fix Strip `NEXT_PUBLIC_DOCS_BASE_PATH` from the referrer pathname; ignore referrers outside the docs and the docs root (the home link already covers it). ## Verification Local production build (`VERCEL_ENV=production pnpm build && pnpm start`, Node 20) checked with headless Chrome on `/docs/cli/references/prompts` (a removed page): | Referrer | Before | After | |---|---|---| | `/docs/cli` | Go back to /docs/cli → `/docs/docs/cli` | Go back to /cli → `/docs/cli` | | `/docs/cli?x=1` | – | Go back to /cli → `/docs/cli?x=1` | | `/pricing` (same origin, not docs) | Go back to /pricing → `/docs/pricing` | no back link | | `/docs/` (root) | Go back to /docs/ → `/docs/docs/` | no back link | | none | no back link | no back link | "Go up to /cli/references" and "Go back home" unchanged in every case. Client-side navigation to a 404 (which uses `usePreviousPathname`, not the referrer) was already correct on production and is untouched. `npx tsc --noEmit` (my file clean; pre-existing `contentlayer/generated` errors before a build), `next lint`, and prettier pass. ## Amp thread - [Merge PRs in series and smoke-test production](https://ampcode.com/threads/T-01a08e26-0c39-723b-95ad-65455002f541) Co-authored-by: Amp <amp@ampcode.com> --------- Co-authored-by: Amp <amp@ampcode.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Amp-Thread-ID: https://ampcode.com/threads/T-01a0913e-aa86-722e-9fa4-ca067d802b46 ## Summary * Upgrades node version to 24 * moves from contentlayer to [contentlayer2](https://github.com/timlrx/contentlayer2) that supports Node v18+ ## Testing * Built successfully locally and on Vercel preview Co-authored-by: Amp <amp@ampcode.com>
…er line in reports (sourcegraph#1916) Follow-ups from testing the PR checks on sourcegraph#1913 / sourcegraph#1914. - Review comments: one suggested change per finding (not one per line), no review body. Each comment starts with an HTML marker; the workflow deletes suggestions whose finding is gone (or that GitHub could no longer place, `line: null`) and skips ones already posted, so resolved suggestions disappear like the spell check's do. - Summary comment and review comments put line, link, problem, and fix each on their own line. - Absolute links to this site get their own **Absolute links** section instead of being lumped into Outbound. - Case-mismatch findings now come with a fix (`/Code-Search/queries` → `/code-search/queries`). - Wording: "Write links on this site as relative paths", "fix the inbound links on these other pages", dropped `https://docs.sourcegraph.com/…`; reproduce command matches `package.json` (`pnpm check links …`). Tested locally against the `test-pr-checks-broken` branch with the CI recipe (baseline from `origin/main`, `--diff`, `--review`); build-mode run (`node dev/check-links.mjs`) still clean. Trade-off: when several fixes sit on one line, applying one suggestion outdates the others until the next run re-posts them, because GitHub will not batch overlapping suggestions. <!-- pr-stack-merge-order --> ## Merge order for the PR-check stack Trial-merged onto `main` in this order with no conflicts: 1. sourcegraph#1946 Vercel build log comment — independent; first so the other PRs' Vercel failures get a readable log 2. sourcegraph#1916 check-links report format — adds `dev/sync-review-comments.sh`, which sourcegraph#1935 calls 3. sourcegraph#1935 redirect check — needs sourcegraph#1916 merged first 4. sourcegraph#1947 spell check comment updates — independent 5. sourcegraph#1944 check-links, generated-docs sync PR — conflicts with sourcegraph#1916 on `dev/check-links.mjs`; rebase after sourcegraph#1916 merges Squash-merge each, then rebase the next onto `main`. sourcegraph#1948 (broken) and sourcegraph#1949 (fixed) are the example PRs that exercise every check; never merge, close them once the stack has landed. --------- Co-authored-by: Amp <amp@ampcode.com>
…sourcegraph#1901) ## Why PRs that only change CI workflows, agent config, or repo docs (`.github/`, `AGENTS.md`, cspell lists, ...) currently trigger a full Vercel build and preview deploy that has nothing to preview. ## What Adds `vercel.json` with an [`ignoreCommand`](https://vercel.com/docs/project-configuration/vercel-json#ignorecommand). Vercel runs it before each build: exit 0 skips, exit 1 builds. The command diffs `HEAD^..HEAD` with these paths excluded: `.github`, `.agents`, `.amp`, `.vscode`, `AGENTS.md`, `README.md`, `.gitignore`, `cspell*`, `dev/TODO.md`. If nothing else changed, the build is skipped. Everything the site builds from (`docs/`, `src/`, `public/`, `dev/`, root configs, lockfile) still builds. `dev/` stays build-relevant because `next.config.js` runs the `dev/check-*.mjs` scripts during `next build`. ## Verification - Ran the exact command against the last 8 commits on `main`: all touched site files and all correctly returned BUILD (including c89ef41, which was mostly `.github`/cspell/README but also touched `src/data/redirects.ts`). - Synthetic commit touching only `.gitignore`, `cspell-allow-list.txt`, `.github/x/y.yml`: exit 0 (SKIP). - Synthetic commit touching `docs/`: exit 1 (BUILD). ## Caveats - Vercel clones `--depth=10` and this compares only the last commit. A push of several commits where only the last is non-site-only would be skipped. Squash merges to `main` are one commit, so production is unaffected. - A skipped build shows on the PR as a canceled Vercel deployment, not a green check. The `main` ruleset has no required status checks, so this does not block merging. - This PR itself only adds `vercel.json`, which is not in the exclude list, so Vercel should still build it. --------- Co-authored-by: Amp <amp@ampcode.com>
## Problem Vercel's Slack and GitHub posts for a production deploy link "Visit" to the raw deployment URL, e.g. `https://sourcegraph-docs-rmeucrf94-sourcegraph-f8c71130.vercel.app/`. In production `basePath` is `/docs`, so nothing serves `/` and Vercel returns a 404. People click away thinking the deploy is broken. | deployment | `/` | `/docs` | |---|---|---| | preview | 200 | 404 | | production | **404** | 200 | ## Change When `basePath` is set, redirect `/` → `/docs` on the same host (`basePath: false` so the source matches the bare `/`). Same host, not `sourcegraph.com/docs`, so the visitor sees the exact deployment in the post rather than whatever is live. 307 so nothing gets cached if we change it later. Preview deployments have no `basePath`, so `redirects()` returns `[]` and `/` keeps serving the homepage as today. sourcegraph.com never proxies `/` to Vercel (only `/docs/*`), so the live site is unaffected. Also hoisted the duplicated `VERCEL_ENV` ternary into one `basePath` const so `basePath`, `NEXT_PUBLIC_DOCS_BASE_PATH`, and the redirect can't drift. ## Verified `VERCEL_ENV=production npx next dev`: ``` / 307 → /docs /docs 200 /docs/admin 200 ``` Without `VERCEL_ENV`: `/` 200, `/admin` 200, no redirect. ## Note sourcegraph#1942 also adds a `redirects` key to `next.config.js`; whichever merges second will need a one-line conflict resolution (keep both entries). Co-authored-by: Amp <amp@ampcode.com>
…h#1946) ## Problem - When a PR's Vercel build fails, the Vercel bot comment and the `Vercel` check link to the Vercel inspector, which only Vercel team members can open - Contributors who aren't Vercel team members see a red X and a login wall, with no hint what broke - Example: sourcegraph#1913 ## Solution - On `vercel.deployment.error` (the same `repository_dispatch` channel `preview-links.yml` uses), comment the tail of the build log on the PR Vercel built the deployment for (`meta.githubPrId`), like the links / redirects / CSpell checks do. Each PR gets its own deployment, so two PRs at the same commit each get their own comment - On the next `vercel.deployment.success`, update that comment to ✅ on every open PR at the commit that has one. The success path only reads PR comments; it does not touch Vercel - Lines that look like credentials (JWTs, `vcp_` / `ghp_` / `github_pat_` / `AKIA…` tokens, `Bearer …`, `*TOKEN=` / `*SECRET=` / `*KEY=` assignments) are redacted before the log is written, since the comment and artifact are public and the build gets `VERCEL_OIDC_TOKEN`, `VERCEL_DEPLOYMENT_KEY` and `VERCEL_ENV_ENC_KEY`. The code fence is sized longer than any backtick run in the log, so a log line cannot close it and inject Markdown ## Token - `VERCEL_TOKEN` repo secret is a [project-scoped token](https://vercel.com/docs/accounts/access-tokens) for `sourcegraph-docs` only, expiring 2026-12-10. Vercel has no read-only scope; project scope is the narrowest it offers, and it can read and write everything in that one project - Enumerated with read-only calls: - Allowed: project settings, environment variables (`/env`, including `?decrypt=true`; the project has none), deployments list, deployment metadata, build log events, domains, custom environments, project list (returns only this project) - Denied: team, team members, user, log drains, webhooks, Edge Config, other projects, minting tokens - Writes within the project (env vars, deployments, domains, settings) are allowed per Vercel's docs; not exercised - `fetch-log` asks GitHub for an open PR from this repository at the commit before it contacts Vercel, so a dispatch for a fork PR or a stale commit never uses the token. `repository_dispatch` runs the workflow and script from `main`, so a PR can't change the code the token is handed to - Anyone with write access can read any repo secret by pushing a workflow; this token limits what that buys them to one Vercel project ## Slack - The Vercel Slack app already posts ":red_circle: … failed to deploy … `<short sha>` | sourcegraph-docs" to `#alerts-vercel-doc-site`. On a failure, a last step finds that post (looking back 30 minutes, then polling for up to 5 more since Vercel and this workflow are triggered by the same event) and uploads the full redacted log into its thread, linking the PR comment. `continue-on-error`, so a Slack problem can't hide the PR comment - Needs the `SLACK_BOT_TOKEN` repo secret and `SLACK_CHANNEL_ID` repo variable; skips quietly without them. The bot is the app in `dev/slack-app-vercel-build-report.json` (`channels:history` to find the post, `files:write` to reply); it must be `/invite`d to the channel - Not yet run end to end; the app and secret are still to be created ## Tested - Run locally against the two example PRs, which is how the comments there got posted (from my account, since GitHub neither delivers `repository_dispatch` nor resolves `workflow_dispatch` for a workflow that isn't on `main` yet): - sourcegraph#1948: ❌ [build log comment](sourcegraph#1948 (comment)) - sourcegraph#1949: ❌ posted on a broken revision, then updated to ✅ [after the fixed revision built](sourcegraph#1949 (comment)) - A PR with no failed build exits with `has no failed build to resolve` - That test found a bug: with two open PRs at the same head SHA, only the first PR the `commits/{sha}/pulls` API listed got the comment. Vercel records the PR a deployment was built for (`meta.githubPrId`), so `fetch-log` now reads it and the comment lands on that PR only. The success path stays off Vercel and keeps the commit lookup, since it only updates comments that already exist - Re-ran `fetch-log` after the reorder: sourcegraph#1948's head → `pull_request=1948`; a commit with no open PR stops at `No open PR with head …` with `VERCEL_TOKEN=invalid`, proving Vercel was not contacted. Redaction and fence sizing checked against JWT, `vcp_`, `ghp_`, `AKIA…`, `Bearer`, `KEY: value` lines and a log line of six backticks - After merge, re-run on a PR by hand: `gh workflow run vercel-build-report.yml -f id=dpl_... -f state=error -f sha=<pr head sha>` <details><summary>Dry-run output (abridged)</summary> > ### ❌ The Vercel build failed for this PR > > Vercel only shows build logs to members of its team, so here is the end of the log. > Run `npm run build` locally to reproduce. > > **Build log** > ``` > Running build in Cleveland, USA (East) – cle1 > ... > ❌ Found 2 dead link(s) in 1 file(s): > 📄 docs/code-search/features.mdx > Line 154: /code-search/no-such-page > ... > ❌ Failed checks: links, filenames > ELIFECYCLE Command failed with exit code 1. > Error: Command "pnpm run build" exited with 1 > ``` </details> ## Amp thread - [Vercel build failure report](https://ampcode.com/threads/T-01a09014-dfa8-740c-95b4-9e28c43cae51) <!-- pr-stack-merge-order --> ## Merge order for the PR-check stack Trial-merged onto `main` in this order with no conflicts: 1. sourcegraph#1946 Vercel build log comment — independent; first so the other PRs' Vercel failures get a readable log 2. sourcegraph#1916 check-links report format — adds `dev/sync-review-comments.sh`, which sourcegraph#1935 calls 3. sourcegraph#1935 redirect check — needs sourcegraph#1916 merged first 4. sourcegraph#1947 spell check comment updates — independent 5. sourcegraph#1944 check-links, generated-docs sync PR — conflicts with sourcegraph#1916 on `dev/check-links.mjs`; rebase after sourcegraph#1916 merges Squash-merge each, then rebase the next onto `main`. sourcegraph#1948 (broken) and sourcegraph#1949 (fixed) are the example PRs that exercise every check; never merge, close them once the stack has landed. --------- Co-authored-by: Amp <amp@ampcode.com>
…#1958) Updates the Agentic Batch Changes guide for GA and splits it into Getting started, Writing prompts, and Configuration and administration. Keeps the existing prompt examples and incorporates the documentation review feedback and code-backed clarifications. The guide distinguishes CI status reporting from log access and repair hooks, explains rollout revisions and merging, and clarifies guidance scope, secrets, ownership, and web-search controls. It omits internal agent-management details and customer-provided model credentials that are not offered at GA. Also updates sidebar navigation and the orb preview service configuration used to review these pages. ## Validation - `pnpm check`: no dead page links, filename violations, or raw image tags. - `pnpm exec prettier --check docs/agentic-batch-changes/*.mdx`: passed. - `git diff --check origin/main...HEAD`: passed. - All three pages returned HTTP 200 during local preview checks; rendered pages, navigation, and affected sections were inspected. - Live-link verification against the branch merge base: both detected changed links resolve. This check does not cover every link added by the page split. - No production build was run. | Link target on the branch preview | Page rendered | Anchor found | | --- | --- | --- | | [/deep-search](https://sourcegraph-docs-git-docs-agentic-b-d7ea61-sourcegraph-f8c71130.vercel.app/deep-search) | Yes | Not applicable | | [/agentic-batch-changes/writing-prompts#during-the-conversation](https://sourcegraph-docs-git-docs-agentic-b-d7ea61-sourcegraph-f8c71130.vercel.app/agentic-batch-changes/writing-prompts#during-the-conversation) | Yes | Yes | --------- Co-authored-by: Amp <amp@ampcode.com>
) Fixing the GitHub action's filter to find the Vercel post in Slack, to attach the build logs in Slack instead of PRs on a public repo, just in case anything sensitive makes it way into the build, and out of the logs. Follow-up to sourcegraph#1946, found by re-triggering the build on sourcegraph#1948 after merging sourcegraph#1946 ## Tested - Build failure logs posted in [Slack](https://sourcegraph.slack.com/archives/C0C25K5RHRN/p1789188631974869?thread_ts=1789185584.403469&cid=C0C25K5RHRN) - Build failure PR comment sourcegraph#1948 (comment) links to the Slack post, instead of posting build logs publicly ## Amp thread - [Vercel build report security review](https://ampcode.com/threads/T-01a093c3-a827-71ba-af20-c13e851c9a77) --------- Co-authored-by: Amp <amp@ampcode.com>
|
@carrascomalany42-lgtm is attempting to deploy a commit to the Sourcegraph Team on Vercel. A member of the Team first needs to authorize it. |
carrascomalany42-lgtm
changed the base branch from
main
to
SEC-3728-admin-passkey-docs
September 15, 2026 11:45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.