From 55c04409d7728662e1793ae97583a9c9e73bc1c7 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Mon, 17 Aug 2026 15:07:53 -0400 Subject: [PATCH 1/3] Add missing .lycheecache entries for links merged without cache updates PRs #130 and #175 added or changed external links without updating the committed .lycheecache, so the cache-coverage guard on main (git diff --exit-code .lycheecache) has been failing since. Regenerated and normalized the cache; warm-run byte-stable. --- .lycheecache | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.lycheecache b/.lycheecache index ba6afb5..0a0e9f8 100644 --- a/.lycheecache +++ b/.lycheecache @@ -16,6 +16,7 @@ https://engineering.nyu.edu/news/open-source-system-secure-software-updates-grad https://events.linuxfoundation.org/events/linuxcon-north-america/program/slides,200,1785781706 https://fuchsia.dev/fuchsia-src/concepts/system/software_update_system,200,1785781705 https://github.com/awslabs/tough,200,1785781707 +https://github.com/bottlerocket-os/bottlerocket/blob/96bf303df357ac434ebcc619d676ecffa1c9bbcb/PUBLISHING.md#roles-and-keys,200,1786993474 https://github.com/cnabio/cnab-spec/blob/cnab-security-1.0.0-ga/300-CNAB-security.md,200,1785781708 https://github.com/cncf/foundation/blob/master/code-of-conduct.md,200,1785781705 https://github.com/davedoesdev/dtuf,200,1785781708 @@ -110,6 +111,8 @@ https://www.datadoghq.com/blog/engineering/secure-publication-of-datadog-agent-i https://www.datadoghq.com/blog/engineering/secure-publication-of-datadog-agent-integrations-with-tuf-and-in-toto/,200,1785781704 https://www.docker.com/blog/signing-docker-official-images-using-openpubkey/,200,1785781705 https://www.drupal.org/project/infrastructure/issues/3325040,200,1785781705 +https://www.enisa.europa.eu/,200,1786993474 +https://www.enisa.europa.eu/sites/default/files/2026-05/Draft%20-%20ENISA%20Technical%20Advisory%20-%20Update%20Mechanisms%20-%20v0.6.pdf,200,1786993474 https://www.helpnetsecurity.com/2019/12/23/update-framework-linux-foundation/,200,1785781705 https://www.jointdevelopment.org/,200,1785781705 https://www.linux-magazine.com/Issues/2014/160/Security-Lessons-TUF,200,1785781704 From f81635f3c06168ada43e5f32d26cae1507321270 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Mon, 17 Aug 2026 16:01:01 -0400 Subject: [PATCH 2/3] Wire the .lycheecache-committed guard into npm test Local runs of npm test previously passed even when check:links had regenerated a .lycheecache that differed from the committed one; only CI's post-run git diff step caught it. Chain the same guard into test via _diff:check:link-cache so the drift is visible pre-push. The check stays out of check:links itself so Netlify's warn-only postbuild path keeps deploys unblocked. --- package.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index 56fadfd..39e70b7 100644 --- a/package.json +++ b/package.json @@ -7,6 +7,7 @@ "_check:links:internal": "npm run _check:links -- --offline", "_check:links": "lychee-norm-cache", "_commit:public": "HASH=$(git rev-parse --short main); cd public && git add -A && git commit -m \"Site at $HASH\"", + "_diff:check:link-cache": "npm run _diff:check -- .lycheecache || (echo; echo 'ERROR: .lycheecache has changed and needs to be committed.'; exit 1)", "_diff:check": "git diff --name-only --exit-code", "_filename-error": "echo 'ERROR: the following files violate naming conventions; fix using: `npm run fix:filenames`'; echo; npm run -s _ls-bad-filenames; exit 1", "_filenames-to-kebab-case": "find assets content -name '*_*' ! -name '[_.]*' -exec sh -c 'mv \"$1\" \"${1//_/-}\"' _ {} \\;", @@ -40,7 +41,7 @@ "refcache": "refcache", "seq": "bash -c 'for cmd in \"$@\"; do npm run $cmd || exit 1; done' - ", "serve": "npm run _serve", - "test": "npm run check:format && npm run check:links", + "test": "npm run check:format && npm run check:links && npm run _diff:check:link-cache", "update:dep": "npm install --save-dev autoprefixer@latest postcss-cli@latest", "update:pkgs": "npx npm-check-updates -u" }, From f016de4940fc7a585abd823fa922e104665363b5 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Mon, 17 Aug 2026 16:48:03 -0400 Subject: [PATCH 3/3] Add a [help] fix hint to the link-cache guard message Match the check:format help idiom. From PR review feedback. --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 39e70b7..9f9ef90 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ "_check:links:internal": "npm run _check:links -- --offline", "_check:links": "lychee-norm-cache", "_commit:public": "HASH=$(git rev-parse --short main); cd public && git add -A && git commit -m \"Site at $HASH\"", - "_diff:check:link-cache": "npm run _diff:check -- .lycheecache || (echo; echo 'ERROR: .lycheecache has changed and needs to be committed.'; exit 1)", + "_diff:check:link-cache": "npm run _diff:check -- .lycheecache || (echo; echo 'ERROR: .lycheecache has changed and needs to be committed.'; echo '[help] Run: git add .lycheecache'; exit 1)", "_diff:check": "git diff --name-only --exit-code", "_filename-error": "echo 'ERROR: the following files violate naming conventions; fix using: `npm run fix:filenames`'; echo; npm run -s _ls-bad-filenames; exit 1", "_filenames-to-kebab-case": "find assets content -name '*_*' ! -name '[_.]*' -exec sh -c 'mv \"$1\" \"${1//_/-}\"' _ {} \\;",