[dependabot]

This restores a reproducible build for the current Docsy 0.9.1 theme while upgrading PostCSS CLI to 11. The previous npm CI had no tracked lockfile, linted deleted Doks directories, and downloaded a Hugo version below the theme's minimum.

• Use Node 22 LTS, a committed public-registry lockfile, and Hugo extended 0.121.2. Remove unused Doks dependencies while retaining existing init/version helpers and the Netlify sitemap plugin.
• Preserve real Markdown rules and Linux, Windows, and macOS coverage. Build the actual repository and a disposable Docsy page/style through the real production PostCSS/autoprefixer pipeline. The temporary context resolves locked project dependencies and is removed afterward.
• Repair the existing Netlify Make entries. Preview/non-production output gets a global noindex header; production rejects a global noindex header. Existing domains, provider events, publishing token name, and target are unchanged.
• Keep the existing JavaScript CodeQL scan on a supported action and reactivate its original workflow after GitHub's inactivity disablement.

Validation on published head b62733db9641a4b9e9b9392914ef6b370e4bcc49:

• Docsy CI: all three platform jobs succeeded, including actual locked install, Markdown rules, production Hugo build, and real stylesheet/autoprefixer output. Linux also passed all three actual Netlify Make entries and the injected-noindex rejection check.
• CodeQL: succeeded on the same head. Current Vercel checks also succeeded. The Netlify Make contract was tested in CI; there is no current hosted Netlify acceptance claim.
• Local checks covered syntax, lock consistency, reviewed-patch replay, checker negative cases, and temporary-context cleanup. No host dependency installation, Hugo build, or server was used.

The existing Markdown toolchain still reports six development-dependency audit entries (four moderate, two high parser/algorithmic DoS reports). No audit warning was suppressed; the separate Markdown tooling upgrade in #16 is being updated for the supported patched dependency chain. The repository still has no documentation content directory, so this verifies tooling rather than a populated website.

Related: GET-325.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
website	Ready	Preview	Oct 30, 2026 7:12pm UTC

[netlify]

❌ Deploy Preview for openkf failed.

Name	Link
🔨 Latest commit	7090512
🔍 Latest deploy log	https://app.netlify.com/sites/openkf/deploys/6630989168cf0600080f7755

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[kubbot]

Reviewed the full current-main diff and final fixture fix. The locked current Docsy toolchain, real production stylesheet/PostCSS, three OS builds, Linux Netlify Make entries and indexing guards, and current-head CodeQL/Vercel checks passed. The inherited Markdown-tool audit debt is tracked separately in #16; this does not claim hosted Netlify or a content-complete product acceptance.