Releases

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

Merge the reusable hugo_landing project into the main site: its shared canvas and accent styles and its landing page rules move into the apex tree, and its landing macro, generated configuration, standalone publisher, and repository-relative rewrite layouts are removed. The theme keeps owning the taxonomy and term layouts, which are richer than the heading-only versions the reusable project carried. Remove the now-unused apex deploy_project.sh and deploy_all.sh landing publishers with it.

Retire the per-project publication and DNS ownership: the project landing targets and the landing deployment command, each landing project’s dnsconfig.json and Terraform root, the build plumbing that served only those stages, and the landing repository and Pages membership in the repository catalog. The apex Terraform root is retained because it also declares VM resources, and no Vault configuration is changed.

Replace the provider-snapshot zone files with generated declaration pages, one per destination view, that project the checked-in declarations and are verified for freshness by the DNS offline check. The DNS linter, both destination pages, the apex site, the skills projection, and the repository quality suite pass, and the whole repository builds.

OpenSpec-Change: projects/alwaldend.com/openspec/changes/consolidate-project-landings-into-apex

LLM-disclaimer: This commit was generated by an LLM.

Manage forge resources with hermetic Terraform rules

Centralize organization, repository, and named access configuration in infra/repos. Adopt existing GitHub resources, protect master defaults while retaining Pages publication on pages, and preserve existing repository identities. Manage GitLab one-time imports, the F-Droid metadata fork, and default-branch protections through Vault-backed authentication. Forgejo consumes the same catalog. Ongoing repository synchronization is deferred.

Retire the eleven Bazel rule landing sites through their owning Terraform workflows, removing their DNS records, Pages repositories, and landing configuration. Move all twelve existing standalone rule modules into tools/ and retain their public interfaces and documentation on the main site.

Add tools/rules_terraform with verified provider downloads, packed mirrors in runfiles, and reusable Terraform execution rules. Enforce one version per provider source at an extensible resolution boundary. Migrate every Terraform consumer to thirteen shared provider pins in third_party/terraform. Execution and command maps belong to rules_terraform; consumers explicitly select generic AL wrappers for authentication and Vault injection. Remove tools/terraform and all 43 checked-in Terraform provider locks. Validate installed providers against the declared archives before execution.

Validation covers all fourteen workspace builds, all thirteen standalone test suites, Terraform consumers, offline real-provider regressions, rendered documentation, formatting, and semantic lint. The full root test run has 295 passing tests and one skip; its only failure is the historical secret scan, reduced to four pre-existing synthetic fixture matches. Earlier live imports and the exact landing retirement scope have verified postconditions; the Terraform rules migration uses only offline implementation checks.

OpenSpec-Change: infra/repos/openspec/changes/archive/2026-09-13-adopt-shared-repository-catalog OpenSpec-Change: infra/src/openspec/changes/archive/2026-09-13-retire-bazel-rule-landings OpenSpec-Change: tools/rules_terraform/openspec/changes/archive/2026-09-14-add-hermetic-terraform-rules OpenSpec-Change: tools/rules_terraform/openspec/changes/archive/2026-09-14-correct-terraform-ownership

LLM-disclaimer: This commit was generated by an LLM.

Deploy project DNS through Terraform modules

Move DNS ownership into each project’s Terraform state using shared modules. Load dnsconfig.json files at runtime, reject conflicting domain ownership, and render their records as a table. Add missing project AppRoles and scoped DNS policies, and document grouping related Terraform resources in modules.

Deploy all 45 owners sequentially: adopt 155 existing records and create 13 missing OpenHands records. Preserve every pre-existing provider record and verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply wrappers with a saved-plan guard for roots that also manage services. Allow bounded aggregate path inventories large enough to deliver this migration while retaining truncation refusal in the delivery tool.

Validate runtime ownership, provider imports and preservation with isolated fixtures, Terraform formatting, wrapper builds, repository quality checks, semantic lint, and project documentation/specification builds.

OpenSpec-Change: infra/dns/openspec/changes/archive/2026-09-13-migrate-project-dns-to-terraform

LLM-disclaimer: This commit was generated by an LLM.

Simplify OpenSpec workspace globs

Collapse OpenSpec source globs to specs and changes, drop redundant package visibility blocks already covered by REPO.bazel, and regenerate the affected catalogs.

LLM-disclaimer: This commit was generated by an LLM.

Publish project sites and reproducible infrastructure diagrams

Build and deploy all 30 remaining project sites with the standard Docsy header, project descriptions and a linked documentation directory. Omit the repeated page title and generated language heading. Remove the unused cgit and xray_manager projects and retire their site resources.

Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct GitHub Pages DNS records. Preserve repeated publication when pages is the remote default branch, and include Rules ISO in the main documentation. Document site onboarding in a registered, validated skill. Keep AL introduction short with useful links and preserve its lifecycle details in a dedicated documentation page.

Render all 15 existing infrastructure Drawio pages with pinned Drawio and Chrome inputs, sandboxed export actions, an update target and freshness checks, and include the maintained diagrams in infra/arch documentation. Paint an opaque white canvas to preserve readability in dark themes.

Validation covers project and apex builds, rendered pages, publisher tests, diagram repeatability and freshness, DNS configuration, Terraform formatting, semantic lint and repository quality.

Goal-Ref: build-and-deploy-every-project-landing-page-a782b800 Attempt-ID: attempt-00941092c164

LLM-disclaimer: This commit was generated by an LLM.

Keep Bazel dependencies lazy and generate the root module

Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule, retain recursive firmware submodules, and use the official contrib_rules_jvm 0.32.0 release. Keep default toolchain registration convenient for consumers.

Move root tool implementations into owning packages while preserving compatibility labels, visibility, manual tags, Python paths, Terraform working directories, pnpm dependency pins, and documentation archive layout. Guard the load-free root BUILD with a parser-based quality test. Generate root MODULE.bazel directly from owning include files, with an update command and freshness/integration tests.

Cache hermetic agent tests, preserve lint analysis across modes, and build only lint outputs in lint mode. Allow normal agent lockfile updates while retaining strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs, with matching checked-in host configuration.

Fix DNSControl command ordering, JSON manifest loading, record filename suffixes, and credential-file wiring through existing Vault environment injection. Add an offline config test. Correct the Git wrapper shebang for direct execution and refresh derived catalogs affected by the Bazel changes.

Validation covers compatibility builds, firmware, documentation outputs, generator freshness, DNS configuration, and a live DNS preview without applying changes. The repository-wide audit also identifies pre-existing test and coverage gaps.

Goal-Ref: avoid-unrelated-bazel-dependency-downloads-638e8329 Attempt-ID: attempt-106ffd5ccaeb

LLM-disclaimer: This commit was generated by an LLM.

Extract DNSControl setup into rules_dnscontrol

Extract the DNSControl setup into rules_dnscontrol, generate its Bazel dependency bundle from project-owned record files, and update the DNS guidance. Move Hugo rules and the worker to role-based package paths, and give each non-nested project a locally owned Hugo landing target that reuses the shared README-to-landing macro.

Clean all landing and Pages DNS records so GitHub Pages serves each project subdomain directly without Cloudflare proxying. Improve the main site with a three-panel home layout, complete project links, documentation explore links, and current deployment guidance.

All affected root-workspace landing, DNS, and site targets pass, along with the nested rules_hugo tests, Buildifier, and repository quality checks.

LLM-disclaimer: This commit was generated by an LLM.

Add standalone documentation rules

Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.

Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.

Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.

This commit was generated by an LLM.

Fix Bazel build caching and tool configuration

This commit was generated by an LLM.

Migrate documentation packaging to docs_filegroup

Preserve custom prefixes, renames, strip prefixes, and standalone workspace behavior.\n\nThis commit was generated by an LLM.

Add spellcheck skill

This commit was generated by an LLM.

Restore light and dark site canvases and set the shared accent

The shared Docsy canvas set the same Bootstrap dark palette and the same black page background on :root, [data-bs-theme="light"], and [data-bs-theme="dark"], so the light/dark toggle changed nothing. The site also rendered Bootstrap’s stock blue instead of its intended accent.

Split the shared palette so light mode uses a pure white canvas with the light-mode palette and dark mode uses a pure black canvas with the dark-mode palette, and keep the pre-stylesheet paint and footer on the active mode. Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons, badges, focus rings, and the dark-mode link tint all derive from one value rather than from a site-local copy.

Both files stay in the reusable shell; the apex site consumes them through the existing declared exports and no longer carries the footer’s own blue.

OpenSpec-Change: projects/hugo_landing/openspec/changes/restore-light-dark-canvas-and-accent

LLM-disclaimer: This commit was generated by an LLM.