Build out new ahoy docs website for v3 release

[ocean]

Summary by CodeRabbit

• New Features

  • Added a full documentation site with a landing page, guides, and reference pages covering setup, command writing, execution, imports, environment variables, shell completion, and YAML configuration.
  • Added automatic documentation deployment to GitHub Pages on main branch updates and manual runs.
  • Added automated dependency update checks and security analysis in CI.

• Style

  • Added formatting, TypeScript, and ignore rules to improve consistency and keep generated files out of version control.

[coderabbitai]

Warning

Review limit reached

@ocean, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: b511f796-ff9d-4e2c-bc61-be15f5f93d4a

📥 Commits

Reviewing files that changed from the base of the PR and between dd9f4ed and 7c1619a.

📒 Files selected for processing (1)

• .github/workflows/zizmor.yml

Walkthrough

Bootstraps a new Astro/Starlight documentation site for the ahoy-cli project. Adds all project scaffolding (package.json, tsconfig, Astro config, content collection), CI/CD workflows (GitHub Pages deploy, zizmor security scan, Dependabot), custom CSS theme variables, and a full documentation content tree covering guides and reference pages.

Changes

Ahoy CLI Documentation Site

Layer / File(s)	Summary
Project scaffolding and tooling package.json, tsconfig.json, .gitignore, .oxfmtrc.json, astro.config.mjs, src/content.config.ts, src/styles/custom.css	Sets up the Astro/Starlight project: dependencies (astro, @astrojs/starlight, sharp, oxlint, oxfmt), TypeScript config, formatter ignore rules, sidebar navigation structure, content collection registration, and CSS theme variables for dark/light modes.
CI/CD and dependency automation .github/workflows/deploy-docs.yml, .github/workflows/zizmor.yml, .github/dependabot.yml	Adds a Pages deploy workflow (build + deploy jobs with concurrency control), a zizmor GitHub Actions security scan workflow, and Dependabot config for weekly npm and github-actions updates.
Docs landing and navigation hub src/content/docs/index.mdx, src/content/docs/guides/next-steps.mdx	Adds the docs landing page with hero, feature cards, quick-start, and explore sections, plus the next-steps hub page linking out to all guides and reference pages.
User guides src/content/docs/guides/getting-started.mdx, src/content/docs/guides/writing-commands.mdx, src/content/docs/guides/command-execution.mdx, src/content/docs/guides/importing.mdx, src/content/docs/guides/environment.mdx, src/content/docs/guides/shell-autocompletion.mdx	Adds six guide pages covering installation/quick-start, command authoring patterns (arguments, chaining, aliases, wrappers, env), config discovery and execution semantics, YAML imports and overrides, environment variable loading, and shell tab completion setup.
Reference pages src/content/docs/reference/cli.mdx, src/content/docs/reference/environment.mdx, src/content/docs/reference/yaml-schema.mdx	Adds the CLI reference (flags, built-in commands, discovery, exit codes, injected env vars), environment variable reference (file format, precedence, organisation patterns), and YAML schema reference (all top-level and per-command fields with a full example).
Removed/replaced files astro-starlight-README.md, README.md, LICENSE	Adds the Starlight starter-kit README (marked for deletion), removes the old repository README and MIT licence text.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 Hippity-hop, a new docs site appears,
With Starlight and Astro to calm devs' fears!
Guides for commands, env vars and more,
CI deploys pages right to your door.
The rabbit typed fast — now go explore! 🌟

---

Note

🎁 Summarized by CodeRabbit Free

The PR author is not assigned a seat. To perform a comprehensive line-by-line review, please assign a seat to the pull request author through the subscription management page by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	oxfmt@​0.56.0
	@​astrojs/​starlight@​0.41.0
	astro@​7.0.2
	oxlint@​1.71.0
	sharp@​0.35.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/sharp@0.35.2 → npm/astro@7.0.2 → npm/@astrojs/starlight@0.41.0 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm astro is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/astro@7.0.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm css-tree is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/astro@7.0.2 → npm/css-tree@3.2.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/css-tree@3.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm js-yaml is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/astro@7.0.2 → npm/@astrojs/starlight@0.41.0 → npm/js-yaml@4.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm node-fetch-native is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/astro@7.0.2 → npm/node-fetch-native@1.6.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-fetch-native@1.6.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm oxfmt is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/oxfmt@0.56.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxfmt@0.56.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm oxfmt is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/oxfmt@0.56.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxfmt@0.56.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report