Migrate documentation automation to Depot CI

.depot/workflows/main.yml

@@ -0,0 +1,86 @@
+name: "depot: main"
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      target:
+        description: Automation to run
+        required: true
+        type: choice
+        default: all
+        options:
+          - all
+          - algolia
+          - factory
+
+concurrency:
+  group: depot-main-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  algolia:
+    name: Trigger Algolia crawl
+    if: >-
+      github.event_name == 'push'
+      || inputs.target == 'all'
+      || inputs.target == 'algolia'
+    runs-on: depot-ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Trigger crawler
+        env:
+          CRAWLER_ID: ${{ secrets.CRAWLER_ID }}
+          CRAWLER_USER_ID: ${{ secrets.CRAWLER_USER_ID }}
+          CRAWLER_API_KEY: ${{ secrets.CRAWLER_API_KEY }}
+        run: |
+          set -euo pipefail
+          curl \
+            --fail-with-body \
+            --request POST \
+            --header 'Content-Type: application/json' \
+            --user "${CRAWLER_USER_ID}:${CRAWLER_API_KEY}" \
+            "https://crawler.algolia.com/api/1/crawlers/${CRAWLER_ID}/reindex"
+
+  factory:
+    name: Publish Factory workflow
+    if: >-
+      github.event_name == 'push'
+      || inputs.target == 'all'
+      || inputs.target == 'factory'
+    runs-on: depot-ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Detect Factory changes
+        id: changes
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+          FORCE_PUBLISH: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          set -euo pipefail
+          changed=false
+          if [[ "$FORCE_PUBLISH" == "true" ]]; then
+            changed=true
+          elif [[ -z "$BEFORE_SHA" || "$BEFORE_SHA" == "0000000000000000000000000000000000000000" ]]; then
+            changed=true
+          elif ! git diff --quiet "$BEFORE_SHA...$GITHUB_SHA" -- .factory-workflows; then
+            changed=true
+          fi
+          echo "changed=$changed" >> "$GITHUB_OUTPUT"
+
+      - name: Publish dependency workflow
+        if: steps.changes.outputs.changed == 'true'
+        uses: elasticclaw/actions/publish-workflow@0a880e0bb75a9957a101962671af55267b778ed3
+        with:
+          hub-endpoint: https://factory.repldev.com
+          token: ${{ secrets.ELASTICCLAW_TOKEN }}
+          workspace: replicated-docs
+          path: .factory-workflows/dependency-update.yaml

.depot/workflows/pr.yml

@@ -0,0 +1,73 @@
+name: "depot: PR"
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: depot-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  label:
+    name: Label PR
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository
+      && !startsWith(github.head_ref, 'deps/')
+    runs-on: depot-ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Add documentation labels
+        env:
+          GH_TOKEN: ${{ secrets.REPLICATED_GH_PAT }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          jq -n '{labels: ["type::feature", "type::docs"]}' \
+            | gh api \
+                --method POST \
+                "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/labels" \
+                --input -
+
+  vale:
+    name: Vale
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: depot-ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Review changed documentation
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: scripts/ci/vale-changed.sh
+
+  factory-workflow:
+    name: Validate Factory workflow
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: depot-ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Validate dependency workflow
+        uses: elasticclaw/actions/publish-workflow@0a880e0bb75a9957a101962671af55267b778ed3
+        with:
+          hub-endpoint: https://factory.repldev.com
+          token: dry-run
+          workspace: replicated-docs
+          path: .factory-workflows/dependency-update.yaml
+          dry-run: true

.depot/workflows/release-notes.yml

@@ -0,0 +1,79 @@
+name: "depot: release notes"
+
+on:
+  repository_dispatch:
+    types:
+      - app-manager-release-notes
+      - embedded-cluster-release-notes
+      - embedded-cluster-release-notes-v3
+      - kubernetes-installer-release-notes
+      - replicated-sdk-release-notes
+      - vendor-portal-release-notes
+  workflow_dispatch:
+    inputs:
+      event_type:
+        description: Release-notes automation to run
+        required: true
+        type: choice
+        options:
+          - app-manager-release-notes
+          - embedded-cluster-release-notes
+          - embedded-cluster-release-notes-v3
+          - kubernetes-installer-release-notes
+          - replicated-sdk-release-notes
+          - vendor-portal-release-notes
+      version:
+        description: Released version or tag
+        required: true
+        type: string
+      prev_version:
+        description: Previous version (Replicated SDK only)
+        required: false
+        type: string
+      dry_run:
+        description: Generate the documentation diff without creating a PR or notifying Slack
+        required: true
+        type: boolean
+        default: true
+
+concurrency:
+  group: >-
+    depot-release-notes-${{
+      github.event.action || inputs.event_type
+    }}-${{
+      github.event.client_payload.version || inputs.version
+    }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  generate:
+    name: Generate release-notes PR
+    runs-on: depot-ubuntu-latest
+    timeout-minutes: 15
+    env:
+      EVENT_TYPE: ${{ github.event.action || inputs.event_type }}
+      VERSION: ${{ github.event.client_payload.version || inputs.version }}
+      PREV_VERSION: ${{ github.event.client_payload.prev_version || inputs.prev_version }}
+      DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }}
+      GH_TOKEN: ${{ secrets.REPLICATED_GH_PAT }}
+      PUBLIC_REPO_TOKEN: ${{ secrets.REPLICATED_GH_PAT }}
+      EC_READ_PAT: ${{ secrets.EC_READ_PAT }}
+      VENDOR_PORTAL_PAT: ${{ secrets.VENDOR_PORTAL_PAT }}
+      KOTS_RELEASE_NOTES_SLACK_WEBHOOK: ${{ secrets.KOTS_RELEASE_NOTES_SLACK_WEBHOOK }}
+      KURL_RELEASE_NOTES_SLACK_WEBHOOK: ${{ secrets.KURL_RELEASE_NOTES_SLACK_WEBHOOK }}
+      EMBEDDED_CLUSTER_RELEASE_NOTES_SLACK_WEBHOOK: ${{ secrets.EMBEDDED_CLUSTER_RELEASE_NOTES_SLACK_WEBHOOK }}
+      REPLICATED_SDK_RELEASE_NOTES_SLACK_WEBHOOK: ${{ secrets.REPLICATED_SDK_RELEASE_NOTES_SLACK_WEBHOOK }}
+      VENDOR_PORTAL_RELEASE_NOTES_SLACK_WEBHOOK: ${{ secrets.VENDOR_PORTAL_RELEASE_NOTES_SLACK_WEBHOOK }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.REPLICATED_GH_PAT }}
+
+      - name: Generate release notes and create or update the PR
+        run: scripts/ci/release-notes.sh

.factory-workflows/dependency-update.yaml

@@ -0,0 +1,145 @@
+schema_version: v1
+name: dependency-update-replicated-docs
+enabled: true
+
+trigger:
+  cron:
+    schedule: "0 21 * * 0"
+    timezone: "America/Chicago"
+    overlap_policy: skip
+    timeout: 2h
+
+enable_manual_trigger: true
+
+tags: ["cron", "dependencies", "npm"]
+color: cyan
+
+stages:
+  - id: start
+    label: Start
+    entry: true
+    on_enter:
+      inject: |
+        Workflow task: update npm dependencies for replicated-docs.
+
+        This is an unattended dependency maintenance workflow. Before making
+        changes, check for an open PR with branch "deps/dependency-update". If
+        it exists, fetch that branch, rebase it onto current main, and reuse it.
+        Otherwise, create that branch from current main.
+
+        Do not ask for permission to start. Say exactly [PROCEED] after the
+        branch is ready.
+
+  - id: working
+    label: Working
+    triggers:
+      - message_contains: "[PROCEED]"
+    on_enter:
+      dependency_updates:
+        ecosystems: [npm]
+        paths: ["replicated-docs"]
+        output: dependency_updates
+        timeout: 30m
+      inject: |
+        npm dependency updates were applied to replicated-docs.
+
+        Keep the change scoped to package.json, package-lock.json, and narrowly
+        required compatibility fixes. Do not modify CI dependencies or files
+        outside the replicated-docs repository.
+
+        Review {{ .Outputs.dependency_updates.files_changed }}. Run these exact
+        validation commands from the replicated-docs directory:
+
+        - npm ci
+        - npm run build
+
+        Fix reasonable compatibility failures. Open or update one grouped PR:
+
+        - Branch: deps/dependency-update
+        - Title: [deps] Update replicated-docs npm dependencies
+        - Labels: dependencies, npm, type::security
+        - Body starts with: "Generated by the replicated-docs dependency-update Factory workflow."
+
+        Say [DONE] with the PR URL only after validation passes and the PR is
+        open. If {{ .Outputs.dependency_updates.files_changed }} is empty, say
+        [NO_CHANGES].
+
+  - id: no-changes
+    label: No Changes
+    triggers:
+      - message_contains: "[NO_CHANGES]"
+    terminal: true
+
+  - id: validate
+    label: Validate
+    triggers:
+      - message_contains: "[DONE]"
+    on_enter:
+      run:
+        command: |
+          bash -lc '
+            set +e
+            tmpdir="$(mktemp -d)"
+            cd replicated-docs
+
+            npm ci >"$tmpdir/npm-ci.log" 2>&1
+            install_status=$?
+
+            npm run build >"$tmpdir/build.log" 2>&1
+            build_status=$?
+
+            jq -n \
+              --argjson install_status "$install_status" \
+              --argjson build_status "$build_status" \
+              --arg install_log "$(tail -c 12000 "$tmpdir/npm-ci.log")" \
+              --arg build_log "$(tail -c 12000 "$tmpdir/build.log")" \
+              '"'"'{
+                status: (if $install_status == 0 and $build_status == 0 then "passed" else "failed" end),
+                checks: [
+                  {name: "npm ci", exit_code: $install_status, log_tail: $install_log},
+                  {name: "npm run build", exit_code: $build_status, log_tail: $build_log}
+                ]
+              }'"'"'
+          '
+        output: validation
+        timeout: 45m
+    gate:
+      output: validation
+      pass:
+        path: status
+        values: [passed]
+      fail:
+        path: status
+        values: [failed, error]
+      required: true
+
+  - id: fix-validation
+    label: Fix Validation
+    triggers:
+      - gate_result:
+          stage: validate
+          verdict: fail
+    on_enter:
+      inject: |
+        Validation failed:
+
+        {{ .Outputs.validation.checks }}
+
+        Fix the scoped dependency compatibility failures, commit and push to
+        the same PR branch, then say [DONE] with the PR URL again. If the
+        failure cannot be fixed safely within scope, explain why and say
+        [FAILED].
+
+  - id: failed
+    label: Failed
+    triggers:
+      - message_contains: "[FAILED]"
+    terminal: true
+
+  - id: complete
+    label: Complete
+    triggers:
+      - gate_result:
+          stage: validate
+          verdict: pass
+    terminal: true