Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions .github/workflows/docs-lint.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
name: Docs Lint

on:
pull_request:
paths:
- 'docs/**'

jobs:
lint:
name: Lint Documentation
runs-on: ubuntu-latest
timeout-minutes: 5

Comment on lines +8 to +13

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Scope workflow token permissions explicitly.

permissions is not set, so token scope depends on repository defaults. For this lint-only job, set least privilege (e.g., contents: read).

Suggested patch
 jobs:
   lint:
     name: Lint Documentation
+    permissions:
+      contents: read
     runs-on: ubuntu-latest

As per coding guidelines, ".github/workflows/**/*.{yml,yaml}: - Pin action versions to SHA. Verify secrets are not exposed and permissions are scoped."

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
jobs:
lint:
name: Lint Documentation
runs-on: ubuntu-latest
timeout-minutes: 5
jobs:
lint:
name: Lint Documentation
permissions:
contents: read
runs-on: ubuntu-latest
timeout-minutes: 5
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/docs-lint.yml around lines 8 - 13, Update the "Lint
Documentation" job (job key `lint`, name "Lint Documentation") to explicitly
scope the workflow token by adding a `permissions` block with least privilege
(e.g., `contents: read`) and pin any used GitHub Actions to commit SHAs rather
than floating versions; also review the job steps for any secret exposures and
ensure secrets are referenced only via `secrets.*`.

steps:
- name: Checkout
uses: actions/checkout@v6

- name: Setup Node.js
uses: actions/setup-node@v6
with:
Comment on lines +15 to +20

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for repo in checkout setup-node; do
  echo "== actions/${repo} =="
  for tag in v6 v5 v4; do
    printf "  %-3s -> " "$tag"
    resp="$(curl -fsSL "https://api.github.com/repos/actions/${repo}/git/ref/tags/${tag}" || true)"
    if echo "$resp" | jq -e '.ref and .object.sha' >/dev/null 2>&1; then
      echo "$resp" | jq -r '"\(.ref) \(.object.sha)"'
    else
      echo "NOT_FOUND"
    fi
  done
done

Repository: ambient-code/platform

Length of output: 478


Pin GitHub Actions to immutable commit SHAs.

Lines 16 and 19 use mutable major version tags (actions/checkout@v6, actions/setup-node@v6) instead of pinned commit SHAs. This violates the workflow hardening guideline and can break unexpectedly if the tag is retagged or removed.

Obtain the commit SHAs from GitHub's releases page (e.g., https://github.com/actions/checkout/releases/tag/v6) or via git ls-remote https://github.com/actions/checkout refs/tags/v6, then replace with the full 40-character SHA.

Patch structure (replace SHA placeholders with actual commit hashes)
-    - name: Checkout
-      uses: actions/checkout@v6
+    - name: Checkout
+      uses: actions/checkout@<commit-sha>

-    - name: Setup Node.js
-      uses: actions/setup-node@v6
+    - name: Setup Node.js
+      uses: actions/setup-node@<commit-sha>

Per guideline: ".github/workflows/**/*.{yml,yaml}: Pin action versions to SHA."

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/docs-lint.yml around lines 15 - 20, Replace the mutable
action tags with pinned commit SHAs for the GitHub Actions steps that use
actions/checkout@v6 and actions/setup-node@v6: locate the steps referencing
"uses: actions/checkout@v6" and "uses: actions/setup-node@v6", query their
release tag SHAs (e.g., via the repository releases page or git ls-remote) and
replace the `@v6` short tag with the full 40-character commit SHA for each action,
ensuring the workflow now references the immutable commit SHAs instead of the
version tags.

node-version: '22'
cache: 'npm'
cache-dependency-path: docs/package-lock.json

- name: Install Vale
run: |
curl -sfL https://github.com/errata-ai/vale/releases/download/v3.12.1/vale_3.12.1_Linux_64-bit.tar.gz | tar xz -C /usr/local/bin vale

- name: Install npm tools
run: npm install -g markdownlint-cli2 cspell

- name: Run Vale
working-directory: docs
run: vale src/content/docs/

- name: Run markdownlint
working-directory: docs
run: markdownlint-cli2 "src/content/docs/**/*.md"

- name: Run cspell
working-directory: docs
run: cspell lint --no-progress "src/content/docs/**/*.md"

- name: Build docs (structural validation)
working-directory: docs
run: |
npm ci
npx playwright install --with-deps chromium
npm run build
Comment on lines +10 to +49
12 changes: 12 additions & 0 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -966,6 +966,18 @@ test-e2e-setup: ## Install e2e test dependencies

e2e-setup: test-e2e-setup ## Alias for test-e2e-setup (backward compatibility)

##@ Documentation Quality

docs-lint: ## Lint documentation content (Vale + markdownlint + cspell)
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Linting documentation..."
@cd docs && vale src/content/docs/ && \
echo "$(COLOR_GREEN)✓$(COLOR_RESET) Vale passed"
@cd docs && npx markdownlint-cli2 "src/content/docs/**/*.md" && \
echo "$(COLOR_GREEN)✓$(COLOR_RESET) markdownlint passed"
@cd docs && npx cspell lint --no-progress "src/content/docs/**/*.md" && \
echo "$(COLOR_GREEN)✓$(COLOR_RESET) cspell passed"
@echo "$(COLOR_GREEN)✓$(COLOR_RESET) All docs lint checks passed"

##@ Documentation Screenshots

screenshots: ## Capture documentation screenshots against running kind cluster
Expand Down
113 changes: 113 additions & 0 deletions docs/.cspell.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,113 @@
{
"version": "0.2",
"language": "en",
"ignorePaths": [
"node_modules",
"dist",
".astro",
"public/images"
],
"ignoreRegExpList": [
"/```[\\s\\S]*?```/g",
"/(https?://[^\\s)]+)/g",
"/`[^`]+`/g",
"/\\{[^}]+\\}/g"
],
"words": [
"acpctl",
"agentready",
"agenticsessions",
"Ambient",
"Amber",
"Anthropic",
"Archie",
"Astro",
"Atlassian",
"autoscaling",
"backoff",
"buildx",
"cadence",
"CORS",
"coderabbit",
"codeready",
"colocation",
"ConfigMap",
"ConfigMaps",
"CronJob",
"CronJobs",
"cspell",
"Cypress",
"frontmatter",
"gofmt",
"golangci",
"Grafana",
"Haiku",
"HTTPS",
"idempotency",
"integrations",
"Jira",
"Kustomize",
"Kubernetes",
"Langfuse",
"Langsmith",
"LangChain",
"langgraph",
"markdownlint",
"mcp",
"Milvus",
"MinIO",
"mkdir",
"monospace",
"namespace",
"namespaces",
"Netlify",
"NextJS",
"OAuth",
"Olivia",
"onboarding",
"OpenShift",
"Opus",
"parallelizable",
"projectsettings",
"Playwright",
"preconfigured",
"Prometheus",
"provisioning",
"quickstart",
"RBAC",
"readability",
"reachable",
"reconciler",
"reconcilers",
"reconciliation",
"rehype",
"remark",
"Rollback",
"rfes",
"rollout",
"RoleBinding",
"repo",
"repos",
"screenshot",
"screenshots",
"Shadcn",
"slugified",
"speedrun",
"Sonnet",
"Starlight",
"subagent",
"subagents",
"Tailscale",
"teardown",
"templated",
"TypeScript",
"unattended",
"automatable",
"uncomitted",
"unmount",
"viewport",
"worktree",
"worktrees",
"YAML"
]
}
15 changes: 15 additions & 0 deletions docs/.markdownlint.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
{
"default": true,
"MD013": false,
"MD025": false,
"MD033": {
"allowed_elements": ["figure", "img", "br", "details", "summary", "Badge"]
},
"MD036": false,
"MD040": false,
"MD041": false,
"MD024": {
"siblings_only": true
},
"MD060": false
}
8 changes: 8 additions & 0 deletions docs/.vale.ini
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
StylesPath = .vale/styles

MinAlertLevel = suggestion

Vocab = ACP

[*.md]
BasedOnStyles = ACP
26 changes: 26 additions & 0 deletions docs/.vale/styles/ACP/ActiveVoice.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
extends: existence
message: "Prefer active voice. '%s' is passive."
level: suggestion
ignorecase: true
tokens:
- 'is created by'
- 'is managed by'
- 'is handled by'
- 'is configured by'
- 'is controlled by'
- 'is provided by'
- 'is defined by'
- 'is required by'
- 'is supported by'
- 'is determined by'
- 'was created'
- 'was configured'
- 'was deleted'
- 'was removed'
- 'was updated'
- 'were created'
- 'were configured'
- 'were deleted'
- 'can be accessed by'
- 'should be configured by'
- 'must be set by'
7 changes: 7 additions & 0 deletions docs/.vale/styles/ACP/HeadingStyle.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
extends: existence
message: "Don't end headings with punctuation: '%s'."
level: error
scope: heading
nonword: true
tokens:
- '[.!?;:]$'
14 changes: 14 additions & 0 deletions docs/.vale/styles/ACP/Jargon.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
extends: existence
message: "Consider explaining '%s' on first use or linking to a glossary."
level: suggestion
ignorecase: false
nonword: true
tokens:
- '\bCRDs?\b'
- '\bRBAC\b'
- '\bPATs?\b'
- '\bMCP\b'
- '\bAG-UI\b'
- '\bCR\b'
- '\bPVC\b'
- '\bHPA\b'
6 changes: 6 additions & 0 deletions docs/.vale/styles/ACP/Readability.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
extends: readability
message: "Reading level is grade %s. Aim for grade 12 or lower."
level: suggestion
metrics:
- Flesch-Kincaid
grade: 12
6 changes: 6 additions & 0 deletions docs/.vale/styles/ACP/SentenceLength.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
extends: occurrence
message: "Sentence has %s words. Try to keep sentences under 30 words."
level: warning
scope: sentence
max: 30
token: '\b\w+\b'
9 changes: 9 additions & 0 deletions docs/.vale/styles/ACP/Terminology.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
extends: substitution
message: "Use '%s' instead of '%s'."
level: error
ignorecase: true
swap:
vTeam: ACP
v-team: ACP
vteam platform: Ambient Code Platform
the vteam: ACP
67 changes: 67 additions & 0 deletions docs/.vale/styles/config/vocabularies/ACP/accept.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
ACP
acpctl
Ambient
Amber
AgentReady
Anthropic
Archie
Astro
Atlassian
Bailey
Bitbucket
Casey
CLI
Claude
ConfigMap
CRD
CRC
Cypress
Dan
Diego
Docker
Emma
Felix
Gemini
GitHub
GitLab
Grafana
Haiku
Jira
Kustomize
Kubernetes
Langfuse
LangChain
Langsmith
Lee
LLM
MinIO
MCP
Morgan
Neil
Netlify
NextJS
OAuth
Olivia
OpenShift
Opus
PAT
Parker
Playwright
Prometheus
Quinn
RBAC
REST
RFE
Riley
Ryan
Shadcn
Sonnet
SSO
Starlight
Stella
Steve
Tailscale
Terry
Tessa
TypeScript
Uma
3 changes: 3 additions & 0 deletions docs/.vale/styles/config/vocabularies/ACP/reject.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
vTeam
v-team
vteam
2 changes: 1 addition & 1 deletion docs/src/content/docs/concepts/workspaces.md
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,7 @@ Choose a token lifetime based on your use case:
| 1 year | 31,536,000 | Long-running integrations |
| No expiration | -- | Persistent service keys that you rotate manually |

4. Click **Create Key**.
1. Click **Create Key**.

### Copying the key

Expand Down
3 changes: 3 additions & 0 deletions docs/src/content/docs/features/session-sharing.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ When multiple users collaborate in a shared session, **each message uses the sen
| Shared session | User A | User B | User B |

**Example:**

- User A creates a session and adds User B as an editor
- Both User A and User B have configured their GitHub integrations
- User A sends "Create a PR" -- the PR is created using User A's GitHub token
Expand All @@ -25,10 +26,12 @@ When multiple users collaborate in a shared session, **each message uses the sen
### Automated Sessions

**API Keys:** Always use the **creator's credentials** (the user who created the API key).

- GitHub commits show the creator's username
- The creator is responsible for all actions performed via their API key

**Scheduled Sessions:** Always use the **creator's credentials** (the user who scheduled the session).

- The session runs as the creating user even when they are offline
- The creator is accountable for all scheduled session behavior

Expand Down
1 change: 1 addition & 0 deletions docs/src/content/docs/guides/migrating-shared-sessions.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ description: How to update existing shared sessions for per-message credential b
## Impact

If you have shared sessions created before this update:

- Messages sent by editors will now use **their own credentials** instead of the session owner's
- If an editor has not configured the required integrations, operations that need those credentials will fail

Expand Down
Loading
Loading