fix(site): close audit findings with pipeline parity, safer imports, and nav cleanup

- make CI run import + linked-stub generation before Jekyll build
- install jq/rsync explicitly in CI and Pages workflows
- add retry/backoff for sparse clone step in import_sources.sh
- generate canonical linked stubs under projects/linked with legacy docs redirects
- enforce LF line endings via .gitattributes
- remove unused _data/navigation.yml
- fix archive nav visibility, stale site-architecture details, and dynamic footer year
- ignore generated artifacts/cache paths in .gitignore

Author: CameronBrooks11

.gitattributes

@@ -0,0 +1,14 @@
+* text=auto
+
+*.sh text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.py text eol=lf
+*.md text eol=lf
+*.html text eol=lf
+*.scss text eol=lf
+Gemfile text eol=lf
+Gemfile.lock text eol=lf
+
+*.png binary
+*.ico binary

.github/workflows/ci.yml

@@ -17,5 +17,13 @@ jobs:
           ruby-version: "3.3" # Not needed with a .ruby-version file
           bundler-cache: true # runs 'bundle install' and caches installed gems automatically
           cache-version: 0 # Increment this number if you need to re-download cached gems
+      - name: Install import tooling
+        run: sudo apt-get update && sudo apt-get install -y jq rsync
+      - name: Import remote repository docs
+        run: bash scripts/import_sources.sh
+      - name: Generate linked project stubs
+        run: python3 scripts/generate_linked_redirects.py
       - name: Build with Jekyll
         run: bundle exec jekyll build
+        env:
+          JEKYLL_ENV: production

.github/workflows/pages.yml

@@ -4,7 +4,7 @@ on:
   push: { branches: ["main"] }
   workflow_dispatch:
   schedule:
-    # 23:11 EST (UTC-5) daily -> 04:11 UTC
+    # 04:11 UTC daily (~23:11 ET winter, ~00:11 ET summer)
     - cron: "11 4 * * *"
 
 permissions:
@@ -29,6 +29,9 @@ jobs:
           ruby-version: "3.3"
           bundler-cache: true
 
+      - name: Install import tooling
+        run: sudo apt-get update && sudo apt-get install -y jq rsync
+
       - name: Setup Pages
         id: pages
         uses: actions/configure-pages@v6

.gitignore

@@ -7,3 +7,9 @@ _site/
 # Ignore folders generated by Bundler
 .bundle/
 vendor/
+__pycache__/
+
+# Ignore generated content from local import/link scripts
+_ext/
+docs/projects/linked/
+projects/linked/

_data/navigation.yml

@@ -1,4 +1,4 @@
 <p class="text-small text-grey-dk-100 mb-0" style="text-align: center;">
-  © 2025 <a href="https://feastorg.github.io" class="text-blue-00">feastorg</a>.  
+  © {{ "now" | date: "%Y" }} <a href="https://feastorg.github.io" class="text-blue-00">feastorg</a>.  
   See the corresponding <a href="https://github.com/feastorg" class="text-grey-dk-100">GitHub repository</a> for license and source details.
 </p>

_includes/footer_custom.html

@@ -11,7 +11,7 @@ feastorg uses a hybrid Jekyll architecture that combines automated content impor
 
 ## Technical Stack
 
-**Core**: Jekyll 4.4+ with Just the Docs v0.10.1, Ruby 3.3, GitHub Pages  
+**Core**: Jekyll 4.4+ with Just the Docs v0.12.0, Ruby 3.3, GitHub Pages  
 **Plugins**: SEO-tag, feed, relative-links, redirect-from, include-cache
 
 ## Content Architecture
@@ -36,7 +36,7 @@ feastorg uses a hybrid Jekyll architecture that combines automated content impor
 
 Some projects maintain standalone GitHub Pages sites but are linked through the hub due to complex CI/CD requirements. For example, hardware projects have their own build pipeline using [bread-infra](https://github.com/feastorg/bread-infra), or the Freeboard Project, which has its own CI/CD setup using auto-generated developer API reference and component documentation from monorepo packages, published via VuePress and GitHub Actions.
 
-These are managed via `_data/linked_projects.json` and automatically generate redirect stub pages.
+These are managed via `_data/linked_projects.json` and automatically generate redirect stub pages under `projects/linked/` (with legacy compatibility redirects under `docs/projects/linked/`).
 
 ## Navigation & Styling
 
@@ -51,7 +51,7 @@ These are managed via `_data/linked_projects.json` and automatically generate re
 
 ## Build Pipeline
 
-**Triggers**: Push to main, daily at 23:11 EST, manual dispatch  
+**Triggers**: Push to main, daily at 04:11 UTC (~23:11 ET in winter / ~00:11 ET in summer), manual dispatch  
 **Process**: Environment setup → Content import → Stub generation → Jekyll build → Deploy
 
 **Features**:

_pages/site-architecture.md

@@ -4,6 +4,7 @@ title: Archive
 permalink: /archive/
 nav_order: 100
 has_children: true
+nav_exclude: false
 ---
 
 ## Archive

archive/README.md

@@ -1,41 +1,54 @@
 #!/usr/bin/env python3
 """
 Generate redirect stub pages for linked projects.
-Each page redirects to a GitHub Pages site and is nested under 'Projects > Linked Projects'.
+Canonical pages are generated under projects/linked, with legacy redirects
+preserved under docs/projects/linked for backward compatibility.
 """
 
 import json
 from pathlib import Path
 
 CONFIG = Path("_data/linked_projects.json")
-OUT_DIR = Path("docs/projects/linked")
+CANONICAL_OUT_DIR = Path("projects/linked")
+LEGACY_OUT_DIR = Path("docs/projects/linked")
 
 
 def main():
     with CONFIG.open("r", encoding="utf-8") as f:
         data = json.load(f)
 
     projects = data.get("linked_projects", [])
-    OUT_DIR.mkdir(parents=True, exist_ok=True)
+    CANONICAL_OUT_DIR.mkdir(parents=True, exist_ok=True)
+    LEGACY_OUT_DIR.mkdir(parents=True, exist_ok=True)
 
     for i, proj in enumerate(projects, 1):
         name = proj["name"]
         title = proj.get("title", name)
         url = proj["url"]
-        path = OUT_DIR / f"{name}.md"
+        canonical_path = CANONICAL_OUT_DIR / f"{name}.md"
+        legacy_path = LEGACY_OUT_DIR / f"{name}.md"
 
-        content = f"""---
+        canonical_content = f"""---
 layout: redirect
 title: {title}
 parent: "Linked Projects 🔗"
 grand_parent: Projects
 nav_order: {i}
 redirect_to: {url}
 ---
+"""
+        legacy_content = f"""---
+layout: redirect
+title: {title}
+nav_exclude: true
+redirect_to: {url}
+---
 """
 
-        path.write_text(content.strip() + "\n", encoding="utf-8")
-        print(f"Generated redirect: {path}")
+        canonical_path.write_text(canonical_content.strip() + "\n", encoding="utf-8")
+        legacy_path.write_text(legacy_content.strip() + "\n", encoding="utf-8")
+        print(f"Generated redirect: {canonical_path}")
+        print(f"Generated legacy redirect: {legacy_path}")
 
 
 if __name__ == "__main__":

scripts/generate_linked_redirects.py

@@ -42,6 +42,44 @@ require_cmd() {
   command -v "$1" >/dev/null 2>&1 || die "$1 not found"
 }
 
+# Retry helper with exponential backoff.
+retry_cmd() {
+  local label="$1"
+  shift
+
+  local max_retries="${IMPORT_MAX_RETRIES:-3}"
+  local base_delay="${IMPORT_RETRY_BASE_SECONDS:-2}"
+  local attempt=1
+  local delay="$base_delay"
+
+  while true; do
+    if "$@"; then
+      return 0
+    fi
+    if (( attempt >= max_retries )); then
+      echo "error: ${label} failed after ${attempt} attempts" >&2
+      return 1
+    fi
+    echo "warning: ${label} failed on attempt ${attempt}/${max_retries}; retrying in ${delay}s..." >&2
+    sleep "$delay"
+    attempt=$((attempt + 1))
+    delay=$((delay * 2))
+  done
+}
+
+clone_sparse_repo() {
+  local url="$1"
+  local ref="$2"
+  local tmp_abs="$3"
+  local sub="$4"
+
+  rm -rf -- "${tmp_abs:?}"
+  git clone --quiet --filter=blob:none --no-checkout --depth 1 --branch "$ref" "$url" "$tmp_abs"
+  git -C "$tmp_abs" sparse-checkout init --cone
+  git -C "$tmp_abs" sparse-checkout set "$sub"
+  git -C "$tmp_abs" checkout --quiet
+}
+
 sanitize_relpath() {
   # Reject empty, absolute, or parent-traversal paths.
   local p="${1:-}"
@@ -80,11 +118,8 @@ jq -c '.sources[]' "$MANIFEST" | while IFS= read -r row; do
   url="https://github.com/${repo}.git"
 
   echo "::group::Clone ${repo}@${ref} -> ${tmp} (sparse: ${sub})"
-  rm -rf -- "${TMP_ABS:?}"
-  git clone --quiet --filter=blob:none --no-checkout --depth 1 --branch "$ref" "$url" "$TMP_ABS"
-  git -C "$TMP_ABS" sparse-checkout init --cone
-  git -C "$TMP_ABS" sparse-checkout set "$sub"
-  git -C "$TMP_ABS" checkout --quiet
+  retry_cmd "clone ${repo}@${ref}" clone_sparse_repo "$url" "$ref" "$TMP_ABS" "$sub" \
+    || die "unable to import ${repo}@${ref}"
   echo "::endgroup::"
 
   echo "::group::Sync ${sub} -> ${mount}"
@@ -115,4 +150,4 @@ jq -c '.sources[]' "$MANIFEST" | while IFS= read -r row; do
     python3 "${ROOT}/scripts/ensure_front_matter.py" "$MOUNT_ABS"
   echo "::endgroup::"
 done
-# --- EOF -----------------------------------------------------------------------
+# --- EOF -----------------------------------------------------------------------