* ci: serialise image builds and stop the API-pages workflow clobbering the lockfile
build_n_push: add a per-ref concurrency group so two quick merges to main can't race the :main tag (last push wins regardless of commit order, and the server auto-pulls :main); add permissions: contents: read; validate .dockerignore and package.json changes in the PR path filter.
generate_api_pages: pin Node 20 and switch npm install -> npm ci so the run can never rewrite the now-tracked package-lock.json with a divergent macOS-resolved tree; stage only src/pages/ipa/resources instead of git add -A; drop --force from the push — a force-push from this workflow would silently rewrite main and destroy any PR merged since its checkout.
* chore: warn when per-page dates are skipped; drop dead per-file git lookup
buildGitDateMap now logs a warning when it emits no dates (git missing or shallow clone) instead of silently blanking every page's Updated line and the sitemap lastmod entries; document the squash-merge assumption behind the --name-only walk. Remove the unused getGitLastModified. Note in CLAUDE.md that npm run start warns under output: 'standalone'. Gen output verified byte-identical.
* ci: self-heal the API-pages push when main moves mid-run
Rebase the single generated-files commit onto the moved branch before pushing, so a PR merged during the multi-minute run no longer rejects the push (the failure --force was presumably papering over). A genuine conflict — a concurrent edit of the generated files themselves — still fails the run loudly with main untouched. Also serialise dispatches with a concurrency group: run history shows several same-day dispatches, and overlapping runs regenerate the same files.
Sandbox-tested against a bare repo: plain push rejected on race; rebase+push lands with both commits intact; true conflict exits 1 leaving the branch tip untouched.
* ci: sync to branch tip before regenerating API pages
A run queued behind another checks out the commit pinned at its dispatch time; regenerating against that stale base means the pre-push rebase replays a snapshot diff, and a file the newer spec removed can silently survive from the prior run. Fetch + reset to the branch tip before generating so the diff is computed against reality. Also note the latest-dispatched-vs-newest-tag caveat on the concurrency comment.
Sandbox-proven: with the old order a removed-in-newer-spec file survives the rebase replay; with sync-first it is gone.
* Prevent stale workflows from overwriting newer published content
* Coderabbit Fix
---------
Co-authored-by: Brandon Hopkins <brandon@techhut.tv>
Stop gitignoring the lockfile and commit a freshly regenerated one so CI and Docker builds install a pinned dependency tree instead of re-resolving `^` ranges on every run. Fresh resolution matches the versions already building (no version changes). Document the convention in CLAUDE.md. Enables `npm ci` as a follow-up.
* Add script to generate sitemap.xml and update related configurations
* chore: add robots.txt referencing sitemap.xml
---------
Co-authored-by: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com>
* docs: refresh CLAUDE.md for Next.js 16 toolchain and API sidebar
- Note Node.js >=20.9 requirement (Next 16 fails the build below this)
- Update dev/build descriptions to mention gen:edit-routes; add start
and gen:edit-routes to the common commands list
- Document the second sidebar file (NavigationAPI.jsx) alongside
NavigationDocs.jsx so the API sidebar is discoverable
* docs: add Security boundaries section to CLAUDE.md
Calls out four posture items relevant to AI-assisted contributions:
the repo is public, .env is committed and must hold placeholders only,
npm run gen pulls upstream main without pinning, and CLAUDE.md itself
is authoritative input to AI sessions and should be reviewed accordingly.
* Documented gen:last-updated and generated src/lib/ files
---------
Co-authored-by: TechHutTV <brandon@techhut.tv>
* Streamlined site-to-site docs in new dedicated section. Removed old use-case guide and added redirects
* restructure use-cases, move network use cases to network sections
* Reorganize network routes and networks documentation structure
- Restructure use cases into by-scenario and by-configuration folders
- Reorganize images to match new doc structure (concepts, by-scenario, by-resource-type)
- Add screenshots for site-to-site guides (home, office, cloud)
- Add policy screenshots for networks use cases
- Update site-to-site docs to use two separate policies instead of bidirectional
- Fix Access Control Groups to use correct destination groups
- Move "Self-Hosted vs Cloud" page to about section
- Update navigation and add redirects for moved pages
- Add CLAUDE.md for Claude Code guidance
* cleaned up network docs/image folder structure
* Align site-to-site use case links and redirects
Co-authored-by: Cursor <cursoragent@cursor.com>
* Update CLAUDE.md with accurate project details
Fix Next.js version (14 → 16), add React 19/Tailwind/Pages Router
details, document MDX page conventions, image paths, and note
absence of test suite.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix broken images and hydration error on networks page
- Restore 6 network index images accidentally deleted in 4116092
- Fix keycloak image filename typo (keycloack -> keycloak)
- Fix hydration mismatch by replacing invalid <p><div> nesting with <div>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix 4 broken internal links found in PR review
- Fix missing by-scenario/ segment in site-to-site-home and
site-to-site-office Tile hrefs (network-routes use-cases index)
- Fix lazy-connections typo to lazy-connection (implement-zero-trust)
- Update stale redirect link to direct path for access-control
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
