Merge upstream main, resolve attribution.mdx conflicts (keep FossaReport)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sabags

.github/styles/CalicoStyle/Substitutions.yml

@@ -3,13 +3,14 @@ extends: substitution
 message: "Use '%s' instead of '%s'."
 level: error
 ignorecase: true
+# Limit to prose text only -- skip inline code, code blocks, and headings.
+# This prevents false positives on metric names (felix_int_dataplane_*),
+# config keys (linuxDataplane), and other code-context identifiers.
+scope: text
+# Only include substitutions NOT already handled by the built-in Vale.Terms check
+# (which enforces casing from vocabulary accept lists). This avoids double-flagging
+# terms like 'kubernetes' -> 'Kubernetes' that are already in CalicoBrands/CalicoAcronyms.
 swap:
   'dataplane': 'data plane'
   'dataplanes': 'data planes'
-  'ebpf': 'eBPF'
-  'helm': 'Helm'
-  'kubernetes': 'Kubernetes'
-  'minikube': 'minikube'
   'quick start': 'quickstart'
-  'addon': 'add-on'
-

.github/styles/config/vocabularies/CalicoAcronyms/accept.txt

@@ -0,0 +1,92 @@
+ACLs?
+APIKeys?
+APIs?
+APIServer
+ARPs?
+ASNs?
+AZs?
+BFDInterface
+BGP
+BGPConfigurations?
+BGPFilters?
+BGPPasswords?
+BGPPeers?
+BGPStatus
+CAs?
+CIDRs?
+CLIs?
+CNIs?
+CPUs?
+CRDs?
+CRs?
+CSRs?
+CVEs?
+DNATs?
+DNS
+DNSCache
+EKS
+ENIs?
+FQDNs?
+GRPCRoute
+HEPs?
+HTTP
+HTTPBin
+HTTPHeaders?
+HTTPMatch
+HTTPPull
+HTTPRoutes?
+ICMP
+IGPs?
+IPAM
+IPForwarding
+IPNATs?
+IPPools?
+IPReservations?
+IPSets?
+IPs?
+IPsec
+IPVS
+ISPs?
+ITOps
+KVs?
+LUTs?
+MCPs?
+MTUs?
+NATs?
+NATOutgoing
+NFLOGs?
+NFQUEUEs?
+NICs?
+NXDomain
+POCs?
+RSTs?
+SAs?
+SCTP
+SIEMs?
+SNATs?
+SREs?
+SSHing
+TCP
+TCPRoute
+TLSRoute
+TTLs?
+UDP
+UDPRoute
+UIs?
+UIDs?
+URLs?
+URIs?
+VLANs?
+VMs?
+VPCs?
+VPNs?
+VPP
+VXLAN
+WAFs?
+WEPs?
+XDP
+YAML
+ANDed
+ARPed
+NATt?ed
+SNATt?ed

.github/styles/config/vocabularies/CalicoBrands/accept.txt

@@ -0,0 +1,65 @@
+Alertmanager
+Atlassian
+Bottlerocket
+BusyBox
+CloudWatch
+ConfigMaps?
+Coraza
+CoreDNS
+DaemonSets?
+Dependabot
+DevOps
+Dikastes
+Dynatrace
+Elasticsearch
+Entra
+Equifax
+Felix
+Felixes
+Firewalld
+Fluentd
+FortiGate
+Fortinet
+GitHub
+Goldmane
+Grafana
+Grype
+Heartbleed
+Istio
+Jira
+Katran
+KubeVirt
+Kiali
+Kibana
+Kubernetes
+Kubespray
+Kuryr
+Linux
+Maglev
+Mellanox
+MetalLB
+Mirai
+Mirantis
+Multus
+NGINX
+Netfilter
+OAuth
+OpenShift
+PowerShell
+Prometheus
+Shopify
+Splunk
+Syft
+Tanzu
+Tigera
+Tigera Operator
+Traefik
+Typhas?
+Unix
+VMware
+Voltron
+Waypoint
+WireGuard
+Wireshark
+WordPress
+zTunnel

.github/styles/config/vocabularies/CalicoDocs/accept.txt

@@ -1,53 +1,4 @@
-BGP
-CIDR[|s]
-CNI[|s]
-DNS
-Fortinet
-IP[|s]
-Coraza
-Entra
-Istio
-Kibana
-Splunk
-Tigera
-Typha
-VM[|s]
-VNet
-YAML
-Wordpress
-[aA]nonymiz[ing|ation]
-[hH]oneypod
-[iI]ntranode
-[nN]amespace[s]?
-[mM]icrosegmentation
-[mM]isconfigur[e|ation]
-[oO]nboard
-[oO]nboarding
-[rR]outable
-[sS]ubnet
-[sS]yslog
-calicoctl
-dex
-etcd
-iptables
-kOps
-kubeadm
-kubelet
-kubenet
-netcat
-nftables
-sysctl
-adjacencies
-Mirantis
-CLI[|s]
-API[|s]
-VMware
-minikube
-subnet(?:work|works)
-Alertmanager
-Jira
-calicoq
-Goldmane
-Tigera Operator
-Maglev
-Dikastes
+# Placeholder token used by scripts/vale-lint.sh to mask $[variable] syntax
+# before passing files to vale. Without this, vale would flag PICKLEVAR as
+# a spelling error in the processed content.
+PICKLEVAR

.github/styles/config/vocabularies/CalicoTerminology/accept.txt

@@ -0,0 +1,141 @@
+adjacencies
+[aA]lphanumeric[s]?
+[aA]nonymiz(e|ed|er|ing|ation)
+[aA]nycast
+[aA]utodetect(ion|ed|s|ing)?
+[bB]ackport(ed|s)?
+[bB]lackhole[ds]?
+[bB]oolean
+[cC]lient[Ss]et
+[cC]luster-?wide
+[cC]luster[Rr]ole[s]?
+[cC]ommandlet[s]?
+[cC]onfig[s]?
+[cC]onntrack
+[cC]ronjob[s]?
+[cC]rontab[s]?
+[cC]ybersecurity
+[dD]atacenter[s]?
+[dD]atapath
+[dD]atasource[s]?
+[dD]atastore[s]?
+[dD]atasheets?
+[dD]eduplicat(e[ds]?|ing|ion)
+[dD]istro[s]?
+[eE]nablement
+[eE]ncap(sulation)?
+[eE]xfiltrat(e|ed|ing|ion)
+[fF]ailover
+[fF]ailsafe
+[fF]irewalled
+[gG]lobal[Nn]etwork[Ss]et[s]?
+[gG]oroutine[s]?
+[hH]airpinning
+[hH]ardcoded
+[hH]ealth[Cc]heck[s]?
+[hH]oneypod[s]?
+[hH]ost[Ee]ndpoint[s]?
+[hH]ostname[s]?
+[hH]otfix(es)?
+[hH]otspot[s]?
+[iI]nlined
+[iI]ntercluster
+[iI]nterdependenc(y|ies)
+[iI]nteroperat(e|ing|ion|ble|bility)
+[iI]nterworking
+[iI]ntranode
+[iI][pP][pP]ool[s]?
+[iI][pP][sS]et[s]?
+[kK]eepalive[s]?
+[lL]iveness
+[lL]oad[Bb]alancer
+[lL]og[Ss]torage
+[lL]ookback
+[lL]oopback
+[lL]ookups?
+[mM]ebibytes?
+[mM]icroarchitecture
+[mM]icrosegmentation
+[mM]iddleware
+[mM]isconfigur(e|ed|ation|ations)
+[mM]ulticast
+[mM]ulticluster
+[mM]ultipath
+[mM]ultitenant
+navbar
+[nN]amespace[ds]?
+[nN]etmask
+[nN]etwork[Pp]olic(y|ies)
+[nN]etwork[Ss]et[s]?
+[nN]exthop[s]?
+[nN]ode[Pp]ort[s]?
+[oO]nboard(ing)?
+[oO]perationalize
+[pP]assthrough
+[pP]eering[s]?
+[pP]erformant
+[pP]reconfigured
+[pP]reload[s]?
+[pP]repopulated
+[pP]reformatted
+[pP]reschedule[ds]?
+[pP]roxi(ed|es)
+[pP]roxying
+quantile[s]?
+[rR]eachability
+[rR]ebalanc(e|ed|ing)
+[rR]egex(es)?
+[rR]einstall(s|ed|ing)?
+[rR]eplica[Ss]et[s]?
+[rR]epurpos(e|ed|ing)
+[rR]escanning
+[rR]esend[s]?
+[rR]esync(ing|s)?
+[rR]ollout[s]?
+[rR]outable
+[rR]outability
+[rR]uleset[s]?
+[sS]andboxed
+[sS]chedulable
+[sS]napshotting
+[sS]napshotter
+[sS]tateful[Ss]et[s]?
+stdin
+stdout
+stderr
+[sS]ubcommand[s]?
+[sS]ubcomponent[s]?
+[sS]ubexpression[s]?
+[sS]ubnet(work)?[s]?
+[sS]ubstring[s]?
+sudo
+[sS]yncer[s]?
+[sS]yntaxes
+[sS]yslog
+[tT]emplated
+[tT]imeframe[s]?
+[tT]olerations?
+[uU]ncordon(ed|ing)?
+[uU]ncomment(ed)?
+[uU]nencapsulated
+[uU]nencrypted
+[uU]nicast
+[uU]nloggable
+[uU]nmanaged
+[uU]noptimized
+[uU]npatched
+[uU]nrecovered
+[uU]nschedulable
+[uU]ntar(red|ring)?
+[uU]ntracked
+[uU]ntrusted
+[uU]plink[s]?
+[uU]serspace
+VNet[s]?
+[vV]eth[s]?
+[vV]irtualiz(e|ed|ation|ing)
+[wW]alkthrough[s]?
+[wW]ebserver[s]?
+[dD]ecap(sulation)?
+[rR]epo[s]?
+[dD]iags