Parent
#1
What to build
The site tracks the Guide with nobody remembering to publish. A scheduled job replaces the Mirror with the current state of docs/guide/ from argusappsec/argus and commits it, so merging documentation upstream is the whole act of shipping it.
The logic is a script the workflow invokes, not logic inside workflow YAML — a workflow cannot be tested and a script can. That split is the reason this ticket has a test seam at all.
No credential exists anywhere. argusappsec/argus is public, so reading it needs none, and writing here uses the workflow's built-in token. It commits straight to the default branch: there are no Translations yet, so the diff has no reader a review gate would serve, and a gate would be pure friction on every upstream docs change.
The Sync deletes as well as adds, so a page removed upstream also leaves the site instead of lingering forever. That is safe because it replaces one directory whose only contents are mirrored pages — future Translation directories are siblings of it, never interleaved, so destructive replacement is structurally unable to reach them. The guarantee comes from the layout, not from an exclusion list somebody must remember to extend.
It must be able to replace a Mirror that was seeded by hand in the scaffold ticket.
See ADR 0002 for the reasoning, including why a committed Mirror beats a build-time fetch and why the pull direction beats a push.
Acceptance criteria
Blocked by
Parent
#1
What to build
The site tracks the Guide with nobody remembering to publish. A scheduled job replaces the Mirror with the current state of
docs/guide/fromargusappsec/argusand commits it, so merging documentation upstream is the whole act of shipping it.The logic is a script the workflow invokes, not logic inside workflow YAML — a workflow cannot be tested and a script can. That split is the reason this ticket has a test seam at all.
No credential exists anywhere.
argusappsec/argusis public, so reading it needs none, and writing here uses the workflow's built-in token. It commits straight to the default branch: there are no Translations yet, so the diff has no reader a review gate would serve, and a gate would be pure friction on every upstream docs change.The Sync deletes as well as adds, so a page removed upstream also leaves the site instead of lingering forever. That is safe because it replaces one directory whose only contents are mirrored pages — future Translation directories are siblings of it, never interleaved, so destructive replacement is structurally unable to reach them. The guarantee comes from the layout, not from an exclusion list somebody must remember to extend.
It must be able to replace a Mirror that was seeded by hand in the scaffold ticket.
See ADR 0002 for the reasoning, including why a committed Mirror beats a build-time fetch and why the pull direction beats a push.
Acceptance criteria
node:testBlocked by