Merge branch 'main' into docs-1034-update-acm

Author: jpipkin1

.github/workflows/deploy-to-pantheon.yml

@@ -0,0 +1,45 @@
+name: Build helpdocs site
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+
+jobs:
+  build-helpdocs-site:
+    runs-on: ubuntu-latest
+    environment:
+      name: production
+      url: https://www.sumologic.com/
+    env:
+      CI: true
+      NODE_ENV: production
+      NODE_OPTIONS: "--max-old-space-size=8192 --max-http-header-size=8192"
+      HOSTNAME: https://www.sumologic.com
+      BASE_URL: /help/
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: '20.x'
+          cache: 'yarn'
+      - name: Docusaurus Webpack cache
+        uses: actions/cache@v3
+        with:
+          path: node_modules/.cache
+          key: ${{ runner.os }}-webpack-cache-${{ hashFiles('yarn.lock') }}
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+      - name: Build the Docusaurus site
+        run: |
+          yarn build
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        id: artifact-upload-step
+        with:
+          name: build-output
+          path: ./build/

.github/workflows/job_build-site.yml

@@ -0,0 +1,110 @@
+name: Deploy to Pantheon
+
+permissions:
+  contents: write
+
+on:
+  workflow_call:
+    inputs:
+      SITE_PATH:
+        description: Destination filepath, must include trailing slash and no leading slash (default is empty string, or the / site root)
+        default: ''
+        type: string
+      PANTHEON_SITE_ID:
+        description: Human-readable site ID
+        type: string
+        required: true
+      PANTHEON_STAGING_ENV_NAME:
+        type: string
+        default: "env-${{ github.sha }}"
+        description: Name of the staging environment (11-char max)
+      PANTHEON_DESTINATION:
+        description: Target Pantheon environment, either 'dev' or 'staging'
+        required: true
+        type: string
+    secrets:
+      PANTHEON_SSH_KEY:
+        required: true
+      PANTHEON_KNOWN_HOSTS:
+        required: true
+      PANTHEON_USER_EMAIL:
+        required: true
+      PANTHEON_AUTH_USER:
+        required: true
+      PANTHEON_AUTH_PASSWORD:
+        required: true
+      PANTHEON_MACHINE_TOKEN:
+        required: true
+
+jobs:
+  deploy-to-pantheon:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install SSH key
+        uses: shimataro/ssh-key-action@v2
+        with:
+          key: ${{ secrets.PANTHEON_SSH_KEY }}
+          config: |
+            Host *.drush.in
+               StrictHostKeyChecking no
+          known_hosts: ${{ secrets.PANTHEON_KNOWN_HOSTS }}
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.2"
+      - name: Install Terminus
+        run: |
+          sudo apt update
+          sudo apt install -y curl php-common php-cli php-xml php-mbstring php-curl git jq
+          php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
+          php -r "if (hash_file('sha384', 'composer-setup.php') === file_get_contents('https://composer.github.io/installer.sig')) { echo 'Installer verified'.PHP_EOL; } else { echo 'Installer corrupt'.PHP_EOL; unlink('composer-setup.php'); exit(1); }"
+          php composer-setup.php
+          php -r "unlink('composer-setup.php');"
+          mv composer.phar /usr/local/bin/composer
+          curl -L https://github.com/pantheon-systems/terminus/releases/download/4.0.3/terminus.phar --output terminus
+          chmod +x terminus
+          mv terminus /usr/local/bin/terminus
+          terminus self:update
+          git config -l | grep 'http\..*\.extraheader' | cut -d= -f1 | xargs -L1 git config --unset-all
+          git config --global user.email "${{ secrets.PANTHEON_USER_EMAIL }}"
+          git config --global user.name "GitHub workflow"
+          echo "PANTHEON_BRANCH=master" >> $GITHUB_ENV
+          echo "PANTHEON_ENV=dev" >> $GITHUB_ENV
+      - name: Retrieve build artifact
+        uses: actions/download-artifact@v5
+        with:
+          name: build-output
+          path: ./build
+      - name: Terminus login
+        run: terminus auth:login --machine-token ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+      - name: Staging environment setup
+        if: inputs.PANTHEON_DESTINATION == 'staging'
+        run: |
+          STAGING_NAME="${{ inputs.PANTHEON_STAGING_ENV_NAME }}"
+          NORMLIZED_STAGING_ENV_NAME="${STAGING_NAME:0:11}"
+          DEV_SITE_EXISTS="$(terminus env:list "${{ inputs.PANTHEON_SITE_ID }}" --format=list | grep "$NORMLIZED_STAGING_ENV_NAME" | wc -l | xargs)"
+          if [ "$DEV_SITE_EXISTS" -eq "0" ]; then
+            terminus multidev:create --no-interaction --no-ansi ${{ inputs.PANTHEON_SITE_ID }}.dev "$NORMLIZED_STAGING_ENV_NAME"
+            terminus lock:enable ${{ inputs.PANTHEON_SITE_ID }}.$NORMLIZED_STAGING_ENV_NAME -- "${{ secrets.PANTHEON_AUTH_USER }}" "${{ secrets.PANTHEON_AUTH_PASSWORD }}"
+          fi
+          terminus connection:set "${{ inputs.PANTHEON_SITE_ID }}.$NORMLIZED_STAGING_ENV_NAME" git
+          echo "PANTHEON_ENV=helpdocs" >> $GITHUB_ENV
+          echo "PANTHEON_BRANCH=$NORMLIZED_STAGING_ENV_NAME" >> $GITHUB_ENV
+      - name: Commit build and deploy to Pantheon repo
+        run: |
+          terminus local:clone --yes --branch="${{ env.PANTHEON_BRANCH }}" ${{ inputs.PANTHEON_SITE_ID }}
+          rsync --archive ./build/ "$HOME/pantheon-local-copies/${{ inputs.PANTHEON_SITE_ID }}/${{ inputs.SITE_PATH }}"
+          chmod -R 755 $HOME/pantheon-local-copies/${{ inputs.PANTHEON_SITE_ID }}/${{ inputs.SITE_PATH }}
+          git -C "$HOME/pantheon-local-copies/${{ inputs.PANTHEON_SITE_ID }}" add .
+          git -C "$HOME/pantheon-local-copies/${{ inputs.PANTHEON_SITE_ID }}" commit -m "Added content from ${{ github.repository }} at ${{ github.sha }}"
+          WATCH_COMMIT=$(git -C "$HOME/pantheon-local-copies/${{ inputs.PANTHEON_SITE_ID }}" rev-parse --verify HEAD)
+          git -C "$HOME/pantheon-local-copies/${{ inputs.PANTHEON_SITE_ID }}" push origin
+          terminus workflow:wait --max 600 --commit $WATCH_COMMIT -- ${{ inputs.PANTHEON_SITE_ID }}.${{ env.PANTHEON_ENV }}
+      - name: Terminus logout
+        if: always()
+        run: |
+          rm -rf $HOME/pantheon-local-copies/${{ inputs.PANTHEON_SITE_ID }}/${{ inputs.SITE_PATH }}
+          terminus auth:logout

.github/workflows/job_pantheon.yml

@@ -0,0 +1,26 @@
+name: Slack notification
+
+on:
+  workflow_call:
+    inputs:
+      SLACK_MESSAGE:
+        type: string
+        required: true
+    secrets:
+      SLACK_URL:
+        required: true
+
+jobs:
+  notify-channel:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a
+        with:
+          webhook: ${{ secrets.SLACK_URL }}
+          webhook-type: incoming-webhook
+          payload: |
+            blocks:
+              - type: "section"
+                text:
+                  type: "mrkdwn"
+                  text: "${{ inputs.SLACK_MESSAGE }}"

.github/workflows/job_slack-notification.yml

@@ -0,0 +1,51 @@
+name: Trigger Jenkins pipeline
+
+on:
+  workflow_call:
+    inputs:
+      JENKINS_TRIGGER_SOURCE:
+        default: "${{ github.event_name }} on ${{ github.ref_name }} in ${{ github.repository }} at ${{ github.sha }}"
+        type: string
+    secrets:
+      WEBOPS_AWS_REGION:
+        required: true
+      WEBOPS_AWS_SG_NAME:
+        required: true
+      WEBOPS_JENKINS_PORT:
+        required: true
+      WEBOPS_JENKINS_HOST:
+        required: true
+      WEBOPS_AWS_ACCESS_KEY:
+        required: true
+      WEBOPS_AWS_SECRET_KEY:
+        required: true
+      WEBOPS_WEBHOOK_TOKEN:
+        required: true
+
+jobs:
+  trigger-jenkins-pipeline:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get runner IP
+        if: always()
+        id: ip
+        uses: haythem/[email protected]
+      - name: Add runner to AWS security group ingress
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.WEBOPS_AWS_ACCESS_KEY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.WEBOPS_AWS_SECRET_KEY }}
+          AWS_DEFAULT_REGION: ${{ secrets.WEBOPS_AWS_REGION }}
+        run: aws ec2 authorize-security-group-ingress --group-name ${{ secrets.WEBOPS_AWS_SG_NAME }} --protocol tcp --port ${{ secrets.WEBOPS_JENKINS_PORT }} --cidr ${{ steps.ip.outputs.ipv4 }}/32
+      - name: Trigger Jenkins pipeline
+        run: |
+          curl -H 'Content-Type: application/json' \
+            -d '{ "TRIGGER_SOURCE": "${{ inputs.JENKINS_TRIGGER_SOURCE }}" }' \
+            -X POST \
+            ${{ secrets.WEBOPS_JENKINS_HOST }}:${{ secrets.WEBOPS_JENKINS_PORT || '80' }}/generic-webhook-trigger/invoke?token=${{ secrets.WEBOPS_WEBHOOK_TOKEN }}
+      - name: Remove runner from AWS security group ingress
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.WEBOPS_AWS_ACCESS_KEY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.WEBOPS_AWS_SECRET_KEY }}
+          AWS_DEFAULT_REGION: ${{ secrets.WEBOPS_AWS_REGION }}
+        if: always()
+        run: aws ec2 revoke-security-group-ingress --group-name ${{ secrets.WEBOPS_AWS_SG_NAME }} --protocol tcp --port ${{ secrets.WEBOPS_JENKINS_PORT }} --cidr ${{ steps.ip.outputs.ipv4 }}/32

.github/workflows/job_trigger-jenkins-pipeline.yml

@@ -36,6 +36,88 @@ jobs:
         run: yarn install --frozen-lockfile
       - name: Build the Docusaurus site
         run: yarn build
+      # --- Disallowed character checks for Pantheon ---
+      # 1) Fail if any file path in the build output contains disallowed characters
+      - name: Check build artifact paths for disallowed characters
+        env:
+          BUILD_DIR: build
+        shell: bash
+        run: |
+          if [ ! -d "$BUILD_DIR" ]; then
+            echo "No $BUILD_DIR directory found; skipping path check."
+            exit 0
+          fi
+          # Disallowed chars: " : < > | * ?
+          OFFENDERS="$(find "$BUILD_DIR" -type f | grep -E '[":<>|*?]')" || true
+          if [ -n "$OFFENDERS" ]; then
+            echo "❌ Disallowed characters found in build artifact paths:"
+            echo "$OFFENDERS"
+            while IFS= read -r p; do
+              rel="${p#$(pwd)/}"
+              [ "$rel" = "$p" ] && rel="$p"
+              badchars=$(echo "$rel" | grep -oE '[":<>|*?]' | tr -d '\n')
+              echo "::error file=${rel}::Disallowed character(s) found in build artifact path: [${badchars}] (Pantheon rejects paths containing any of: \" : < > | * ?)"
+            done <<< "$OFFENDERS"
+            exit 1
+          fi
+          echo "✅ No disallowed characters found in build artifact paths."
+      # 2) Fail if any Markdown/MDX link target contains disallowed characters (excluding external links).
+      #    Ignores fenced code blocks (```/~~~) and inline code (`...`) to avoid false positives from code samples.
+      - name: Check Markdown/MDX links for disallowed characters
+        shell: bash
+        run: |
+          FILES="$(git ls-files '*.md' '*.mdx' 2>/dev/null || true)"
+          if [ -z "$FILES" ]; then
+            echo "No Markdown/MDX files found; skipping link check."
+            exit 0
+          fi
+          BAD_LINKS=$(
+            awk '
+              BEGIN { in_code=0 }
+              {
+                raw=$0
+
+                # Toggle fenced code blocks starting with ``` or ~~~
+                if (match(raw, /^\s*(```|~~~)/)) { in_code = !in_code; next }
+                if (in_code) { next }
+
+                # Strip inline code spans so patterns inside don’t trigger
+                line = raw
+                gsub(/`[^`]*`/, "", line)
+
+                # Find real Markdown links: [text](url)
+                while (match(line, /\[[^]]+\]\(([^)]+)\)/, m)) {
+                  url=m[1]
+
+                  # Skip external schemes
+                  if (url ~ /^(https?:|mailto:|tel:)/) { line=substr(line, RSTART+RLENGTH); continue }
+
+                  # Drop query + fragment
+                  sub(/\?.*$/, "", url)
+                  sub(/#.*/, "", url)
+
+                  # Disallowed characters in relative link targets: " : < > | * ?
+                  if (url ~ /[":<>|*?]/) {
+                    printf("%s\t%d\t%s\n", FILENAME, FNR, m[0])
+                  }
+
+                  line=substr(line, RSTART+RLENGTH)
+                }
+              }
+            ' $FILES
+          )
+
+          if [ -n "$BAD_LINKS" ]; then
+            echo "❌ Disallowed characters found in Markdown/MDX link targets:"
+            echo "$BAD_LINKS"
+            while IFS=$'\t' read -r file line match; do
+              [ -z "$file" ] && continue
+              badchars=$(echo "$match" | grep -oE '[":<>|*?]' | tr -d '\n')
+              echo "::error file=${file},line=${line}::Disallowed character(s) in Markdown link target: [${badchars}] ${match} (Not allowed: \" : < > | * ?)"
+            done <<< "$BAD_LINKS"
+            exit 1
+          fi
+          echo "✅ No disallowed characters found in Markdown/MDX link targets."
   spellcheck:
     runs-on: ubuntu-latest
     steps: