Automated PR Testing (#2469)

.github/workflows/cleanup.yml

@@ -20,6 +20,8 @@
 
 name: Cleanup Artifacts
 
+permissions: {}
+
 on:
   workflow_call:
 

.github/workflows/deploy.yml

@@ -20,6 +20,11 @@
 
 name: Deploy Website Build
 
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
 on:
   workflow_call:
     inputs:
@@ -74,7 +79,7 @@ jobs:
 
       - if: inputs.netlify_preview
         name: Limit length of Netlify alias to 12
-        run: echo "SHORT_ALIAS=`echo ${{ inputs.netlify_alias }} | cut -c1-12`" >> $GITHUB_ENV
+        run: echo "SHORT_ALIAS=$(echo "${{ inputs.netlify_alias }}" | cut -c1-12)" >> "$GITHUB_ENV"
 
       - if: inputs.netlify_preview
         id: deployment

.github/workflows/download-repo.yml

@@ -20,6 +20,9 @@
 
 name: Download Repository
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/publish-mirror.yml

@@ -20,6 +20,9 @@
 
 name: 🪞 Push to Mirrors
 
+permissions:
+  contents: read
+
 on: [ push, delete, create ]
 
 # Ensures that only one mirror task will run at a time.

.github/workflows/publish-pr.yml

@@ -18,7 +18,7 @@
 # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
 # IN THE SOFTWARE.
 
-name: 📦 Publish Pull Request Preview
+name: 📦 PR Preview
 
 on:
   pull_request_target:

.github/workflows/publish-release.yml

@@ -18,7 +18,7 @@
 # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
 # IN THE SOFTWARE.
 
-name: 📦 Publish Release
+name: 📦 Release
 
 on:
   push:

.github/workflows/test-lint.yml

@@ -0,0 +1,73 @@
+# Copyright (c) 2024 Jonah Aragon <[email protected]>
+
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to
+# deal in the Software without restriction, including without limitation the
+# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+# sell copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+# IN THE SOFTWARE.
+
+name: 🤖 Linting
+
+permissions:
+  contents: read
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+
+  megalinter:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: MegaLinter
+        id: ml
+        # You can override MegaLinter flavor used to have faster performances
+        # More info at https://megalinter.io/flavors/
+        uses: oxsecurity/megalinter/flavors/[email protected]
+        env:
+          # All available variables are described in documentation
+          # https://megalinter.io/configuration/
+          VALIDATE_ALL_CODEBASE: true
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY
+          DISABLE: COPYPASTE,SPELL,HTML
+          DISABLE_LINTERS: JSON_JSONLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER
+          DISABLE_ERRORS_LINTERS: CSS_STYLELINT,MARKDOWN_MARKDOWN_LINK_CHECK,YAML_YAMLLINT
+          EDITORCONFIG_EDITORCONFIG_CHECKER_ARGUMENTS: -disable-indentation
+          ENV_DOTENV_LINTER_ARGUMENTS: "--skip QuoteCharacter"
+          MARKDOWN_MARKDOWN_LINK_CHECK_FILTER_REGEX_INCLUDE: (docs)
+          MARKDOWN_MARKDOWNLINT_CONFIG_FILE: .markdownlint.yml
+          MARKDOWN_MARKDOWNLINT_FILTER_REGEX_EXCLUDE: (PULL_REQUEST_TEMPLATE\.md)
+
+      # Upload MegaLinter artifacts
+      - name: Archive production artifacts
+        if: success() || failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: MegaLinter reports
+          path: |
+            megalinter-reports
+            mega-linter.log

.github/workflows/upload-crowdin.yml

@@ -20,6 +20,9 @@
 
 name: 💬 Crowdin Upload
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:

.gitignore

@@ -18,11 +18,6 @@ site
 /config/.cache/plugin/social/*
 !/config/.cache/plugin/social/fonts
 
-# Editor settings
-.vscode/*
-!.vscode/extensions.json
-!.vscode/settings.json
-
 # Local Netlify folder
 .netlify
 node_modules

.markdownlint.yml

@@ -24,8 +24,7 @@ ul-indent:
   indent: 4
 no-inline-html: false
 code-block-style: false
-no-hard-tabs:
-  spaces-per-tab: 4
+no-hard-tabs: true
 emphasis-style:
   style: "asterisk"
 no-duplicate-header: false

.vscode/.empty-schema.json

@@ -0,0 +1 @@
+{}

.vscode/extensions.json

@@ -23,6 +23,9 @@
     "EditorConfig.EditorConfig",
     "DavidAnson.vscode-markdownlint",
     "wholroyd.jinja",
-    "mikestead.dotenv"
+    "mikestead.dotenv",
+    "redhat.vscode-yaml",
+    "ecmel.vscode-html-css",
+    "yzhang.markdown-all-in-one"
   ]
 }

.vscode/settings.json

@@ -20,8 +20,30 @@
 
 {
     "git.ignoreLimitWarning": true,
+    "ltex.diagnosticSeverity": "hint",
     "[markdown]": {
       "editor.unicodeHighlight.ambiguousCharacters": true,
-      "editor.unicodeHighlight.invisibleCharacters": true
-    }
+      "editor.unicodeHighlight.invisibleCharacters": true,
+      "editor.defaultFormatter": "DavidAnson.vscode-markdownlint"
+    },
+    "[yaml]": {
+      "editor.defaultFormatter": "redhat.vscode-yaml",
+      "editor.quickSuggestions": {
+        "other": true,
+        "comments": false,
+        "strings": true
+      }
+    },
+    "yaml.schemas": {
+      "https://raw.githubusercontent.com/DavidAnson/markdownlint/main/schema/markdownlint-config-schema.json": ".markdownlint.yml",
+      "https://json.schemastore.org/github-issue-config.json": ".github/ISSUE_TEMPLATE/config.yml",
+      ".vscode/.empty-schema.json": "config/*.yml"
+    },
+    "yaml.customTags": [
+      "!ENV sequence",
+      "!ENV",
+      "tag:yaml.org,2002:python/name:pymdownx.superfences.fence_code_format",
+      "tag:yaml.org,2002:python/name:material.extensions.emoji.twemoji",
+      "tag:yaml.org,2002:python/name:material.extensions.emoji.to_svg"
+    ]
 }

README.md

@@ -1,4 +1,4 @@
-<!-- markdownlint-disable MD041 -->
+<!-- markdownlint-disable MD041 MD045 -->
 <div align="center">
   <a href="https://www.privacyguides.org">
     <picture>
@@ -50,9 +50,9 @@ The current list of team members can be found [here](https://www.privacyguides.o
 - 💖 [Sponsor the project](https://github.com/sponsors/privacyguides)
 - 🈴 [Help translate the site](https://crowdin.com/project/privacyguides) [[Matrix chat](https://matrix.to/#/#pg-i18n:aragon.sh)]
 - 📝 Edit the site, everything's accessible in this repo
-  - Browse our [open issues](https://github.com/privacyguides/privacyguides.org/issues) to see what needs to be updated
-  - View the list of [approved topics waiting for a PR](https://discuss.privacyguides.net/tag/approved)
-  - Read some writing tips in our [style guide](https://www.privacyguides.org/en/meta/writing-style)
+    - Browse our [open issues](https://github.com/privacyguides/privacyguides.org/issues) to see what needs to be updated
+    - View the list of [approved topics waiting for a PR](https://discuss.privacyguides.net/tag/approved)
+    - Read some writing tips in our [style guide](https://www.privacyguides.org/en/meta/writing-style)
 
 All contributors to the site are listed [here](https://github.com/privacyguides/privacyguides.org/graphs/contributors). If you make a substantial (i.e. copyright eligible) contribution to the project and would like to be formally credited, you are welcome to include your information in the appropriate `authors` section in [`CITATION.cff`](/CITATION.cff) as well, just submit a PR or ask @jonaharagon to make the change.
 

config/mkdocs-common.yml

@@ -87,7 +87,6 @@ extra:
 
 repo_url: https://github.com/privacyguides/privacyguides.org
 repo_name: ""
-edit_uri: edit/main/docs/
 
 theme:
   name: material

crowdin.yml

@@ -18,25 +18,26 @@
 # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
 # IN THE SOFTWARE.
 
+#checkov:skip=CKV_SECRET_6:obviously a variable name and not a secret
 api_token_env: CROWDIN_PERSONAL_TOKEN
 project_id: "509862"
 "preserve_hierarchy": true
 files:
-- source: "/docs/**/*.*"
-  translation: "/i18n/%two_letters_code%/**/%file_name%.%file_extension%"
-  skip_untranslated_files: false
-- source: "/theme/overrides/*.en.html"
-  translation: "/theme/overrides/%file_name%.%two_letters_code%.html"
-  translation_replace:
-    "en.": ""
-  skip_untranslated_files: false
-- source: "/includes/*.en.*"
-  translation: "/includes/%file_name%.%two_letters_code%.%file_extension%"
-  translation_replace:
-    "en.": ""
-  skip_untranslated_files: false
-- source: "/static/i18n/*.en.*"
-  translation: "/static/i18n/%file_name%.%two_letters_code%.%file_extension%"
-  translation_replace:
-    "en.": ""
-  skip_untranslated_files: false
+  - source: "/docs/**/*.*"
+    translation: "/i18n/%two_letters_code%/**/%file_name%.%file_extension%"
+    skip_untranslated_files: false
+  - source: "/theme/overrides/*.en.html"
+    translation: "/theme/overrides/%file_name%.%two_letters_code%.html"
+    translation_replace:
+      "en.": ""
+    skip_untranslated_files: false
+  - source: "/includes/*.en.*"
+    translation: "/includes/%file_name%.%two_letters_code%.%file_extension%"
+    translation_replace:
+      "en.": ""
+    skip_untranslated_files: false
+  - source: "/static/i18n/*.en.*"
+    translation: "/static/i18n/%file_name%.%two_letters_code%.%file_extension%"
+    translation_replace:
+      "en.": ""
+    skip_untranslated_files: false

docs/about/index.md

@@ -48,12 +48,12 @@ So far in 2023 we've launched international translations of our website in [Fren
 <!-- markdownlint-disable MD030 -->
 
 <div class="grid cards" markdown>
-<!-- Every team member should have a unique emoji.
-     Team member cards should include ONLY the following links:
-     - Discourse Profile
-     - ONE Link of team member's choice
-     - Email if applicable
-     This is to keep it fair and not spammy, especially as we grow.
+<!--  Every team member should have a unique emoji.
+      Team member cards should include ONLY the following links:
+      - Discourse Profile
+      - ONE Link of team member's choice
+      - Email if applicable
+      This is to keep it fair and not spammy, especially as we grow.
 -->
 
 -   :robot:{ .lg .middle } **@jonah**

docs/about/privacytools.md

@@ -1,8 +1,6 @@
 ---
 title: "PrivacyTools FAQ"
 ---
-# Why we moved on from PrivacyTools
-
 In September 2021, every active contributor unanimously agreed to move from PrivacyTools to work on this site: Privacy Guides. This decision was made because PrivacyTools’ founder and controller of the domain name had disappeared for an extended period of time and could not be contacted.
 
 Having built a reputable site and set of services on PrivacyTools.io, this caused grave concerns for the future of PrivacyTools, as any future disruption could wipe out the entire organization with no recovery method. This transition was communicated to the PrivacyTools community many months in advance via a variety of channels including its blog, Twitter, Reddit, and Mastodon to ensure the entire process went as smoothly as possible. We did this to ensure nobody was kept in the dark, which has been our modus operandi since our team was created, and to make sure Privacy Guides was recognized as the same reliable organization that PrivacyTools was before the transition.
@@ -49,11 +47,11 @@ Reddit requires that subreddits have active moderators. If the primary moderator
 
 On September 14th, 2021, we [announced](https://blog.privacyguides.org/2021/09/14/welcome-to-privacy-guides) the beginning of our migration to this new domain:
 
-> [...] we found it necessary to make this switch sooner rather than later to ensure people would find out about this transition as soon as possible. This gives us adequate time to transition the domain name, which is currently redirecting to www.privacyguides.org, and it hopefully gives everyone enough time to notice the change, update bookmarks and websites, etc.
+> [...] we found it necessary to make this switch sooner rather than later to ensure people would find out about this transition as soon as possible. This gives us adequate time to transition the domain name, which is currently redirecting to `www.privacyguides.org`, and it hopefully gives everyone enough time to notice the change, update bookmarks and websites, etc.
 
 This change [entailed:](https://reddit.com/comments/pnhn4a)
 
-- Redirecting www.privacytools.io to [www.privacyguides.org](https://www.privacyguides.org).
+- Redirecting `www.privacytools.io` to [www.privacyguides.org](https://www.privacyguides.org).
 - Archiving the source code on GitHub to preserve our past work and issue tracker, which we continued to use for months of future development of this site.
 - Posting announcements to our subreddit and various other communities informing people of the official change.
 - Formally closing privacytools.io services, like Matrix and Mastodon, and encouraging existing users to migrate as soon as possible.
@@ -64,7 +62,7 @@ Things appeared to be going smoothly, and most of our active community made the
 
 Roughly a week following the transition, BurungHantu returned online for the first time in nearly a year, however nobody on our team was willing to return to PrivacyTools because of his historic unreliability. Rather than apologize for his prolonged absence, he immediately went on the offensive and positioned the transition to Privacy Guides as an attack against him and his project. He subsequently [deleted](https://reddit.com/comments/pp9yie/comment/hd49wbn) many of these posts when it was pointed out by the community that he had been absent and abandoned the project.
 
-At this point, BurungHantu claimed he wanted to continue working on privacytools.io on his own and requested that we remove the redirect from www.privacytools.io to [www.privacyguides.org](https://www.privacyguides.org). We obliged and requested that he keep the subdomains for Matrix, Mastodon, and PeerTube active for us to run as a public service to our community for at least a few months, in order to allow users on those platforms to easily migrate to other accounts. Due to the federated nature of the services we provided, they were tied to specific domain names making it very difficult to migrate (and in some cases impossible).
+At this point, BurungHantu claimed he wanted to continue working on privacytools.io on his own and requested that we remove the redirect from `www.privacytools.io` to [www.privacyguides.org](https://www.privacyguides.org). We obliged and requested that he keep the subdomains for Matrix, Mastodon, and PeerTube active for us to run as a public service to our community for at least a few months, in order to allow users on those platforms to easily migrate to other accounts. Due to the federated nature of the services we provided, they were tied to specific domain names making it very difficult to migrate (and in some cases impossible).
 
 Unfortunately, because control of the r/privacytoolsIO subreddit was not returned to BurungHantu at his demand (further information below), those subdomains were [cut off](https://reddit.com/comments/pymthv/comment/hexwrps) at the beginning of October, ending any migration possibilities to any users still using those services.
 
@@ -84,7 +82,7 @@ After the launch of [r/PrivacyGuides](https://reddit.com/r/privacyguides), it wa
 
 > [...] The growth of this Sub was the result of great effort, across several years, by the PrivacyGuides.org team. And by every one of you.
 >
-> A Subreddit is a great deal of work to administer and moderate. Like a garden, it requires patient tending and daily care. It’s not a task for dilettantes or commitment-challenged people. It can’t thrive under a gardener who abandons it for several years, then shows up demanding this year’s harvest as their tribute. It’s unfair to the team formed years ago. It’s unfair to you. [...]
+> A Subreddit is a great deal of work to administer and moderate. Like a garden, it requires patient tending and daily care. It's not a task for dilettantes or commitment-challenged people. It can’t thrive under a gardener who abandons it for several years, then shows up demanding this year’s harvest as their tribute. It's unfair to the team formed years ago. It’s unfair to you. [...]
 
 Subreddits do not belong to anybody, and they especially do not belong to brand-holders. They belong to their communities, and the community and its moderators made the decision to support the move to r/PrivacyGuides.
 
@@ -100,7 +98,7 @@ Our fundraising platform, OpenCollective, is another source of contention. Our p
 
 Thus, the funds in OpenCollective belong to Privacy Guides, they were given to our project, and not the owner of a well known domain name. In the announcement made to donors on September 17th, 2021, we offered refunds to any donor who disagrees with the stance we took, but nobody has taken us up on this offer:
 
-> If any sponsors or backers disagree with or feel misled by these recent events and would like to request a refund given these highly unusual circumstances, please get in touch with our project admin by emailing [email protected].
+> If any sponsors or backers disagree with or feel misled by these recent events and would like to request a refund given these highly unusual circumstances, please get in touch with our project admin by emailing `[email protected]`.
 
 ## Further Reading
 

docs/about/services.md

@@ -13,14 +13,14 @@ We run a number of web services to test out features and promote cool decentrali
 ## Gitea
 
 - Domain: [code.privacyguides.dev](https://code.privacyguides.dev)
-- Availability: Invite-Only  
+- Availability: Invite-Only
 Access may be granted upon request to any team working on *Privacy Guides*-related development or content.
 - Source: [snapcraft.io/gitea](https://snapcraft.io/gitea)
 
 ## Matrix
 
 - Domain: [matrix.privacyguides.org](https://matrix.privacyguides.org)
-- Availability: Invite-Only  
+- Availability: Invite-Only
 Access may be granted upon request to Privacy Guides team members, Matrix moderators, third-party Matrix community administrators, Matrix bot operators, and other individuals in need of a reliable Matrix presence.
 - Source: [github.com/spantaleev/matrix-docker-ansible-deploy](https://github.com/spantaleev/matrix-docker-ansible-deploy)
 
@@ -33,6 +33,6 @@ Access may be granted upon request to Privacy Guides team members, Matrix modera
 ## Invidious
 
 - Domain: [invidious.privacyguides.net](https://invidious.privacyguides.net)
-- Availability: Semi-Public  
+- Availability: Semi-Public
 We host Invidious primarily to serve embedded YouTube videos on our website, this instance is not intended for general-purpose use and may be limited at any time.
 - Source: [github.com/iv-org/invidious](https://github.com/iv-org/invidious)

docs/advanced/dns-overview.md

@@ -354,8 +354,8 @@ dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +
 If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
 
 ```text
-o-o.myaddr.l.google.com. 60	IN	TXT	"198.51.100.32"
-o-o.myaddr.l.google.com. 60	IN	TXT	"edns0-client-subnet 198.51.100.0/24"
+o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
+o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
 ;; Query time: 64 msec
 ;; SERVER: 9.9.9.11#53(9.9.9.11)
 ;; WHEN: Wed Mar 13 10:23:08 CDT 2024