feat: custom stylesheets

.github/workflows/ci.yml

@@ -9,20 +9,33 @@ on:
     tags:
       - "v*.*.*"
 
+  # pull_request runs the matrix/build on the PR head with the fork-scoped token
+  # (no comment perms on base repo).
   pull_request:
     branches:
       - develop
 
+  # pull_request_target runs repo-owned checks (e.g., Danger comments) on the base ref with the base repo token;
+  # never executes PR code.
+  pull_request_target:
+    branches:
+      - develop
+
 concurrency:
   group: ${{format('{0}:{1}', github.repository, github.ref)}}
   cancel-in-progress: true
 
 jobs:
   cpp-matrix:
+    if: github.event_name != 'pull_request_target'
     runs-on: ubuntu-24.04
     container:
       image: ubuntu:24.04
     name: Generate Test Matrix
+    # Permissions allow Danger to read PR context and post comments.
+    permissions:
+      contents: read
+      pull-requests: write
     outputs:
       matrix: ${{ steps.cpp-matrix.outputs.matrix }}
       llvm-matrix: ${{ steps.llvm-matrix.outputs.llvm-matrix }}
@@ -120,6 +133,7 @@ jobs:
           node .github/releases-matrix.js
 
   build:
+    if: github.event_name != 'pull_request_target'
     needs: cpp-matrix
 
     strategy:
@@ -1013,6 +1027,7 @@ jobs:
                 root="$(pwd)/demos/$project/$variant"
                 src="$root/adoc"
                 dst="$root/adoc-asciidoc"
+                stylesheet="$(pwd)/share/mrdocs/addons/generator/common/layouts/style.css"
 
                 # Create the top-level output dir
                 mkdir -p "$dst"
@@ -1023,7 +1038,7 @@ jobs:
                   rel="${f#"$src/"}"                 # path relative to $src
                   outdir="$dst/$(dirname "$rel")"    # mirror subdir inside $dst
                   mkdir -p "$outdir"
-                  asciidoctor -D "$outdir" "$f"
+                  asciidoctor -a stylesheet="${stylesheet}" -D "$outdir" "$f"
                 done
               done
             fi
@@ -1293,3 +1308,33 @@ jobs:
           llvm_dir="/var/www/mrdox.com/llvm+clang"
           chmod 755 ${{ matrix.llvm-archive-filename }}
           scp -o StrictHostKeyChecking=no $(pwd)/${{ matrix.llvm-archive-filename }} [email protected]:$llvm_dir/
+
+  repo-checks:
+    name: Repo checks
+    # Run under pull_request_target so we can use the base-repo token to comment on forked PRs
+    # without executing forked code in this job. Declared after the matrix job so the matrix stays first in the UI.
+    if: github.event_name == 'pull_request_target'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+      statuses: write
+    steps:
+      - name: Checkout base revision
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install repo-check tools
+        run: npm --prefix util/danger ci
+
+      - name: Repo checks (Danger)
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npx --prefix util/danger danger ci --dangerfile util/danger/dangerfile.ts

.gitignore

@@ -20,6 +20,12 @@
 /share/mrdocs/libcxx/
 /share/mrdocs/clang/
 /docs/modules/reference
+/node_modules
 /.gdbinit
 /.lldbinit
-/.github/node_modules/
+/.github/node_modules/
+/util/danger/node_modules/
+/.roadmap
+/AGENTS.md
+# Ignore hidden OS files under golden fixtures
+test-files/golden-tests/**/.*