DOC-6939 Stop publishing HTML-commented content to the AI outputs - #3758
Merged
Conversation
Hugo runs with unsafe = true, so an HTML comment passes through to the rendered page and is invisible to readers, which is how authors park prose that should not be published yet. Nothing in the AI output path knew that, so commented text reached the JSON feed as real section content and the Markdown output as real body text. We were publishing to AI consumers exactly what we withhold from readers, which is worse than a formatting defect: an assistant can cite a feature as documented when we have deliberately not documented it. The case that surfaced it was develop/clients/observability, where a comment holds an entire "Tracing overview" section, kept because the explanation is good but the clients do not support tracing yet. The feed published it as a section with 1,610 characters of prose and the table of contents listed it, pointing at an anchor that does not exist because Hugo renders no heading for commented-out text. Across the corpus, 56 files carry HTML comments totalling about 22,000 characters. The important thing to know before touching the pattern: HTML comments legitimately appear inside code examples. A Maven snippet on the Lettuce pages carries "</version> <!-- Check for the latest version on Maven Central -->" mid-line, and stripping that would damage the sample a reader sees. Requiring the open delimiter to sit at the start of a line is what separates an author's parked block from a comment inside a code sample. Measured over the whole corpus, the line-anchored form removes 48 comments and about 19,200 characters and never matches inside a fenced code block, where the unanchored form matches 9 times. I nearly rejected the right pattern on a bad measurement, which is worth recording. My first safety test asked whether a match overlapped a fenced code block, and reported 8 overlaps even for the line-anchored form. Those 8 were comments that *contain* a code block, which is exactly what should be removed -- the opposite of the dangerous case, a comment sitting *inside* a code block. Asking the right question, whether the match is fully contained by a code span, gives 0 for the anchored form and 9 for the unanchored one. Verified by building before and after and comparing every page's content field: 5,706 pages byte-identical, 27 shrank, every one of the 27 explained by having a line-anchored comment, and none grew. No line-anchored comment now survives into either sections[] or the Markdown output. Duplicate section and example ids stay at zero and content_hash still verifies for all 5,687 content pages. Deliberately not fixed by editing the content. The comment is a legitimate authoring choice, and removing it would have fixed one page and left 55. Learned: HTML comments legitimately appear inside code examples, so comment stripping has to be line-anchored -- an unanchored pattern damages a Maven snippet on the Lettuce pages and 8 other sites Learned: a safety check asking whether a match "overlaps" a code block conflates two opposite situations, a comment that contains a code block against a comment inside one, and it wrongly condemned the correct pattern until the test asked about containment instead Constraint: the comment strip must keep its line-anchored open delimiter in both places, or it starts eating comments out of code samples Constraint: the strip is implemented twice, in layouts/partials/process-markdown-content.html and layouts/partials/toc-from-markdown.html, and must be changed together Gaps: inline comments, about 2,800 characters, still reach the outputs -- almost all of it is part of a code sample and belongs there; and a block comment written at column 0 inside a fenced code block would still be stripped, though none exists today Ticket: DOC-6939 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Contributor
🧠 Redis MemoryFound 5 related items from repository history: Memory updated at 2c4e608 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stops content inside HTML comments reaching the JSON feed and the per-page Markdown — item D4 of DOC-6939.
The defect
Hugo runs with
unsafe = true, so an HTML comment passes straight through to the rendered page. It's invisible to readers, which is exactly how authors park prose that shouldn't be published yet. Nothing in the AI output path knew that, so commented text was being treated as publishable content.We were publishing to AI consumers exactly what we withhold from readers. That's worse than a formatting defect — an assistant can cite a feature as documented when we have deliberately not documented it.
The case that surfaced it is
develop/clients/observability, where a comment holds an entire "Tracing overview" section, kept because the explanation is good but the clients don't support tracing yet:sections[]in the feedAcross the corpus, 56 files carry HTML comments totalling about 22,000 characters. Only 2 of those comments contain a heading, which is why just one showed up in an anchor-parity check — the other 54 leak their prose into whatever section encloses them, invisible to any id-based metric.
The fix, and why it's line-anchored
A line-anchored strip in
process-markdown-content.html(the choke point feeding both the JSONcontentfield and the Markdown output) and intoc-from-markdown.html(which reads.RawContentdirectly).The open delimiter must be at the start of a line, and that's load-bearing. HTML comments legitimately appear inside code examples — the Lettuce pages carry a Maven snippet with
</version> <!-- Check for the latest version on Maven Central -->mid-line, and stripping that damages a sample a reader sees. Column-0 is what separates an author's parked block from a comment inside a code sample:(?s)<!--.*?-->(?ms)^<!--.*?-->Both the literal and entity-escaped forms are matched, because
.RawContentarrives escaped in some contexts.Verification
Built before and after, comparing every page's
contentfield:sections[]or the.mdoutputcontent_hashverifies 5,687/5,687What a reviewer should focus on
process-markdown-content.htmlfeeds only the JSON and Markdown output formats, not the HTML, so nothing readers see changes.Deliberately not fixed in the content
The comment on
observability.mdis a legitimate authoring choice — good prose held back until the clients catch up. Removing it would have fixed one page and left 55. The defect is that our pipeline treated invisible content as publishable.Not in this PR
Relationship to #3757
Independent. #3757 (D3 + C7) changes how titles and ids are derived; this changes what content is considered publishable. Both edit
toc-from-markdown.htmlbut in different regions — line ~27 here against lines 47+ there — so they merge cleanly in either order.🤖 Generated with Claude Code
Note
Medium Risk
Intentional content removal from JSON/Markdown for ~27 pages; wrong regex anchoring could damage code samples, but rendered site HTML is out of scope.
Overview
Stops author-parked HTML comment blocks from being treated as publishable content in the JSON feed, per-page Markdown, and metadata TOC—while leaving the normal Hugo HTML site unchanged.
process-markdown-content.htmlnow removes line-anchored<!-- ... -->blocks (and entity-escaped equivalents) before embeds, shortcodes, and other transforms, sosections[]/ body text no longer include prose that readers never see (e.g. a commented-out “Tracing overview” on observability). The pattern requires the opening delimiter at column 0 so mid-line comments inside code samples (Maven snippets, etc.) are not stripped.toc-from-markdown.htmlapplies the same line-anchored strip after fenced code blocks are removed, so commented headings do not appear as TOC entries with dead anchors.Scope: ~27 AI-facing pages shrink by design; inline comments and rendered HTML are unaffected. Relaxing line anchoring would risk stripping comments inside fenced code at known sites.
Reviewed by Cursor Bugbot for commit 2c4e608. Bugbot is set up for automated code reviews on this repo. Configure here.