Add Cloudflare CLI page; bring image, Renovate and troubleshooting pages up to date with #204
ea7e34f
Bring image and Renovate pages up to date with #175 and the widened tracking
Choosing an Image: agent-browser is the default browser tool in both claude-code variants, gh and gh-stack are pinned, and the example tag matches the real hugo-bun versions. Image Tags: Renovate tracks eleven ARGs across four images in two groups, not four tools; the build triggers include the files an image copies in.
3e258bf
Make the destructive commands impossible to mistake for a step
"Never run these" was a bash block styled exactly like every safe command on the
page, sitting right after the cleanup instructions. Someone working down the page
and pasting as they go would have run it; the only thing marking it dangerous was
a trailing comment.
Now a table with the consequence in the wider column, under a heading that reads
as a stop sign, with the flags split from the commands so no line in it works if
pasted. Spells out that "not attached to a running container" includes every
stopped devcontainer's database and credential volumes.
388ee91
Bring the page in line with the ruleset that now exists
- Status banner: ruleset 22666492 is active; the steps are kept as a rebuild
and rollback path, not a to-do list.
- Fixed a broken anchor left by renaming the ralphex-fe section, and the
troubleshooting entry that still pointed at a deleted workflow and promised
'three fixes'.
- Recorded that a partial PUT sending only enforcement is safe -- verified on a
throwaway ruleset targeting a nonexistent branch, then deleted: rules, bypass
actors and conditions all survived.
- Step 4 now uses the real ruleset id and shows the exact expected output
instead of a placeholder.
- 3.4 links the live ruleset and points at Rule Insights.
2e16088
Replace ruleset click-paths with verified API calls
The UI steps were written from GitHub's docs, which lag the settings UI, and
were wrong three times running -- sidebar section name, the order of Bypass
list vs Target branches, and an instruction to select GitHub Actions as a
bypass actor, which the picker does not offer.
Steps 1 and 3 are now gh commands that were actually executed against this
repository, with the stored result read back to confirm each field. Records
what the API accepted: ~DEFAULT_BRANCH as the ref condition, and
RepositoryRole/5 for the admin bypass, which GitHub does not document
numerically -- confirmed by current_user_can_bypass coming back as 'always'.
Creates the ruleset disabled first so it can be inspected before it gates
anything, with the enable and rollback calls alongside.
The ralphex-fe direct-push gap is resolved rather than open: #134 deletes that
workflow and routes Bun and Hugo through Renovate. Section now records the
constraint for whoever adds the next workflow.
a9e0f21
Make step 3 instructions, not prose
16 numbered clicks with no interleaved rationale. The 'why' for each
non-obvious choice -- admin bypass, no Renovate bypass, non-strict checks, no
required reviews -- moved to the existing 'Why the gate is shaped this way'
section at the end, where it does not sit between a reader and their next
click. Known gap cut from an essay to a test command and two options.
eeaafb9
Correct the ruleset steps against the live UI
Reported from the actual settings page; the steps had been written from
GitHub's docs, which lag the UI.
- Sidebar section is 'Code, planning, and automation', not 'Code and
automation'.
- Bypass list comes before Target branches in the editor; the steps had them
the other way round.
- GitHub Actions cannot be added as a bypass actor. The picker offers repo
roles (Deploy keys, Repository admin, Maintain, Write) and GitHub Apps
installed on the repo (Claude, Copilot, Copilot code review, Claude agent,
Renovate, Travis CI). GitHub Actions is built in rather than installed, so
it never appears. The old step 3.4 told the reader to select it.
That last one invalidated the plan for update-and-build-ralphex-fe.yml, which
pushes to master as github-actions[bot]. Whether a ruleset's required status
check actually blocks a push is not stated plainly in the docs, so the page no
longer asserts either way: it records the gap, notes the workflow is
workflow_dispatch-only and so cannot break silently, gives a one-command test,
and lists three fixes. The best is annotating ARG BUN_VERSION and
ARG HUGO_VERSION with '# renovate:' so Renovate handles those bumps by PR and
the direct-push workflow can be deleted outright.
Also: don't add Renovate to the bypass list -- it must stay subject to the rule.
Added a standing note that the docs lag the UI, so the next reader trusts the
screen over this page.
11c298c
Restructure wiki: consumer guides, runbooks, and a documented split rule
Establishes what belongs in the wiki versus the repo: a document that goes
stale when this repo's code changes lives in the repo; one that goes stale when
an external system changes -- Docker Desktop, GitHub settings, an upstream tool
-- or that spans several images lives here. Per-image READMEs therefore stay put,
because a tag list has to move in the same commit as its Dockerfile.
New consumer-facing pages:
- Choosing an Image: decision table across the six images, plus the
fixed-toolchain vs bring-your-own-toolchain distinction that matters more
than the tool lists.
- Image Tags and Rebuild Policy: what :latest means and when it moves, the two
tag schemes, which tags are immutable, and the Renovate update policy
including the 3-day soak with claude-code exempt.
- Troubleshooting: cross-image symptoms only, each citing its issue.
Moved from the repo tree (zero coupling to repo code, so nothing is lost by
their no longer being reviewed in a PR):
- docs/docker-maintenance-cheatsheet.md -> Docker Disk Maintenance
- docs/disk-usage.md -> Incident: Docker Disk Exhaustion (2026-09-07)
Every page now ends with a Sources section citing the PRs and issues its
knowledge came from, and a Last verified date -- wiki pages rot silently and
nothing else signals it. Added _Sidebar.md for navigation.
e712c1c
Add branch protection / Renovate auto-merge runbook
Step-by-step procedure for requiring the CI complete check on master so
Renovate's grouped agent-tool PRs auto-merge on green. UI click-paths use the
exact labels from GitHub's ruleset docs, with a CLI equivalent, verification
commands, and troubleshooting keyed to observed symptoms.
Home.md becomes an index rather than the default placeholder.
ae8aae8