release: promote development to main (academy tutorials + ConNext pivot + partners on app/solution pages)

.github/workflows/deploy.yml

@@ -0,0 +1,268 @@
+# Build the site and deploy it to Cloudflare Pages.
+#
+# Replaces the old `documentation.yml`, which published to the `gh-pages`
+# branch for GitHub Pages. GitHub Pages no longer serves this site:
+# www.conduction.nl is a Cloudflare Pages project (`conduction-website`),
+# and DNS has pointed there for some time. The gh-pages branch was still
+# being written on every push, and GitHub Pages still claimed the custom
+# domain, so the repo carried a second publishing path that produced
+# nothing anyone could see. Both are retired now.
+#
+# Requires two ORG secrets (they already exist; the names matter):
+#   CF_API_TOKEN   - token with the "Cloudflare Pages: Edit" permission
+#   CF_ACCOUNT_ID  - the account owning the conduction-website project
+#
+# ConductionNL/.github's deploy-docs.yml uses the same two names; this workflow
+# asked for CLOUDFLARE_API_TOKEN, which is not a secret anywhere, so wrangler
+# got an empty token.
+#
+# Until those exist the deploy step fails loudly, which is the intended
+# behaviour: a deploy that cannot authenticate must not look like a
+# success. Builds on pull requests do not need them.
+
+name: Deploy
+
+on:
+  push:
+    branches: [development]
+  pull_request:
+    branches: [development]
+  # Nightly rebuild so app-downloads.json (regenerated by the npm prebuild
+  # step) reflects fresh GitHub release-asset counts. 07:00 UTC = 09:00
+  # Amsterdam (CEST) / 08:00 (CET). Inherited from the workflow this
+  # replaces; the counts are fetched at build time, so a rebuild is the
+  # only way they change.
+  schedule:
+    - cron: '0 7 * * *'
+  workflow_dispatch:
+
+# A newer push should win rather than race an in-flight deploy to the same
+# production URL. PRs are grouped per-branch so they cancel their own runs.
+concurrency:
+  group: deploy-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    # Build, a Chromium download, and an e2e suite whose slowest test spends
+    # 40 seconds proving the game cannot end.
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+
+      # The prebuild step shells out to python3 to refresh app-downloads.json.
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
+
+      # Runs prebuild (app-downloads) then `docusaurus build`, producing
+      # build/ with the English site and build/nl/ with the Dutch one.
+      #
+      # GITHUB_TOKEN is not optional in practice. The prebuild step counts
+      # release-asset downloads across the ConductionNL repos, and an
+      # unauthenticated caller is rate-limited long before it finishes: the
+      # fetch then fails soft, keeps whatever app-downloads.json is
+      # committed, and the build goes green with frozen numbers. Since
+      # refreshing those numbers is the entire purpose of the nightly run,
+      # a silent fallback would make this job theatre.
+      # PIPELINQ_ENQUIRY_ENDPOINT is what makes the forms work at all. Without
+      # it the build falls back to the localhost dev default, EnquiryForm sees
+      # an http endpoint on an https page, and every visitor is shown the email
+      # fallback instead of a form that submits. That is not hypothetical: it
+      # is what production did until this line existed, which is why no website
+      # enquiry ever reached the CRM.
+      #
+      # A repository VARIABLE, not a secret: it is a public URL that every
+      # visitor's browser sends a request to, so hiding it buys nothing and
+      # costs the ability to read the deploy log and see where leads went.
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PIPELINQ_ENQUIRY_ENDPOINT: ${{ vars.PIPELINQ_ENQUIRY_ENDPOINT }}
+          # Traffic measurement, from our own Portaliq portal. Unset and the
+          # plugin is not wired at all, which is what production did until
+          # now: the app was installed on the portal and the site sent it
+          # nothing, so there was no measurement and nothing said so.
+          #
+          # A variable rather than a secret, for the same reason as the
+          # endpoint above: it is an origin every visitor's browser fetches a
+          # script from, so it is public by construction.
+          PORTALIQ_TRAFFIC_ORIGIN: ${{ vars.PORTALIQ_TRAFFIC_ORIGIN }}
+          PORTALIQ_TRAFFIC_PORTAL: ${{ vars.PORTALIQ_TRAFFIC_PORTAL }}
+        run: npm run build
+
+      # The build cannot fail on a missing endpoint, because a preview build of
+      # a docs-only PR has no reason to carry one. It CAN refuse to deploy a
+      # production build that would ship forms nobody can submit, which is the
+      # failure this whole change exists to end.
+      - name: The production build must carry a real enquiry endpoint
+        # Same condition as the Deploy step below, deliberately: this guards
+        # what actually ships, so if the two ever disagree the guard is either
+        # blocking a build nobody deploys or waving through one they do.
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/development'
+        run: |
+          # Matched on the CONFIG KEY, never on the bare host. `localhost:8080`
+          # on its own appears in 19 bundle files, because the academy
+          # tutorials are full of "Host http://localhost:8080, basic auth
+          # admin:admin" and they are supposed to be. Grepping for the host
+          # alone made this step fail every single deploy while looking like a
+          # careful safety check, which is worse than not having one. Measured
+          # against a real build, not assumed: key+host matches exactly one
+          # file, the config in main.*.js.
+          if grep -rqF 'pipelinqEnquiryEndpoint:"http://localhost' build/assets/js/; then
+            echo "::error::The build baked in the localhost dev endpoint. Set the PIPELINQ_ENQUIRY_ENDPOINT repository variable, or every form on the site degrades to the email fallback and no enquiry reaches the CRM."
+            exit 1
+          fi
+          echo "Enquiry endpoint is not the dev default."
+
+      # A variable that is set but does nothing is worse than one that is
+      # unset, because it reads as measurement being on. The plugin only
+      # emits its tag when the origin is present, so if the variable is set
+      # the built pages must carry the script; if it is unset, they must not.
+      # Both directions, because either way round is a lie about whether
+      # visitors are being measured.
+      - name: Traffic measurement is on exactly when it is configured
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/development'
+        run: |
+          # Matched on the client ROUTE, which nothing else on the site
+          # requests, rather than on the portal host: that host is also the
+          # enquiry endpoint and appears in the bundle regardless.
+          if grep -rqF 'api/traffic-client.js' build/index.html; then
+            found=yes
+          else
+            found=no
+          fi
+          if [ -n "${{ vars.PORTALIQ_TRAFFIC_ORIGIN }}" ] && [ "$found" = no ]; then
+            echo "::error::PORTALIQ_TRAFFIC_ORIGIN is set but the build carries no traffic client, so nothing is being measured."
+            exit 1
+          fi
+          if [ -z "${{ vars.PORTALIQ_TRAFFIC_ORIGIN }}" ] && [ "$found" = yes ]; then
+            echo "::error::The build carries a traffic client with no origin configured."
+            exit 1
+          fi
+          echo "Traffic client present: $found, which matches the configuration."
+
+      - name: Check the build produced both locales
+        run: |
+          test -f build/index.html || { echo "::error::build/index.html missing"; exit 1; }
+          test -f build/nl/index.html || { echo "::error::build/nl/index.html missing"; exit 1; }
+
+      # WebKit is Safari's engine and therefore most phones. The suite ran
+      # zero percent of it until 2026-09-22, because the mobile project was
+      # pinned to chromium on the grounds that layout is engine-agnostic.
+      # Largely, not entirely: the one difference that showed up was a race
+      # the drawer test was losing on WebKit and winning on Chromium.
+      # Both engines are installed in one step now that both gate the deploy.
+      # A failed install should look like the infrastructure problem it is,
+      # not like a silent gap in coverage.
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium webkit
+
+      # Runs against the build produced above, not a dev server, because the
+      # failures worth catching here only exist in a production build:
+      # hydration mismatches need a server-rendered page to hydrate, and the
+      # cookie CLI's styling depends on hashed CSS-module class names.
+      # This gates the deploy on purpose. A page that fails to hydrate looks
+      # perfect in a screenshot, so "it built" is not evidence it works.
+      - name: End-to-end tests
+        run: npx playwright test --project=chromium --project=mobile --project=mobile-safari
+
+      - name: Upload the Playwright report on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 7
+
+      # `--branch main` is load-bearing and has nothing to do with this
+      # repo's branches. Cloudflare Pages treats one branch name per project
+      # as production; for conduction-website that name is `main`. Deploying
+      # from `development` under its own name would create a *preview*
+      # deployment on a random *.pages.dev URL, succeed, and never reach
+      # www.conduction.nl. Push events on development are production.
+      # DIAGNOSTIC, and deliberately non-fatal. This workflow has never once
+      # deployed successfully: `--project-name=conduction-website` is the only
+      # name it has ever used, and Cloudflare answers
+      # `Authentication error [code: 10000]` on
+      # /accounts/*/pages/projects/conduction-website — while the SAME
+      # CF_API_TOKEN deploys the `conduction-docs` project from
+      # ConductionNL/.github without complaint. So the token is valid and the
+      # name or its scope is wrong. Listing the projects the token can actually
+      # reach turns that guess into a measurement, in the log, without anyone
+      # opening the dashboard.
+      #
+      # `continue-on-error` on purpose: a diagnostic that can fail the build is
+      # a second failure mode, not a diagnosis.
+      # PREFLIGHT, and deliberately non-fatal on its own — the deploy below is
+      # what fails. It exists because the deploy's own error says only
+      # "Authentication error [code: 10000]", which reads as a bad token and is
+      # not one.
+      #
+      # MEASURED 2026-08-23, after this workflow had failed 30 runs out of 30:
+      #   /accounts/*/pages/projects        -> Authentication error 10000
+      #   /accounts/*/workers/scripts       -> ok, 42 scripts
+      #   /zones                            -> ok
+      # So CF_API_TOKEN carries Workers and zone-read and NO Pages permission at
+      # all. Not a wrong project name: the Pages LIST endpoint, which names no
+      # project, is refused too. `conduction-website` is real — it exists and
+      # serves www.conduction.nl, conduction.nl, academy., commonground. and
+      # connext. — the token just cannot see it.
+      #
+      # That also explains why ConductionNL/.github deploys docs.conduction.nl
+      # with this same token: every docs site in the fleet is a WORKER
+      # (`wrangler deploy`, name `<app>-docs`), and Workers is the permission
+      # this token has.
+      #
+      # THE FIX IS ONE DASHBOARD EDIT: add `Cloudflare Pages: Edit` to the org
+      # secret CF_API_TOKEN. Until then this step says so in the log, so the
+      # failure below names its cause instead of looking like a bad secret.
+      - name: Preflight — can this token see Cloudflare Pages
+        if: github.event_name != 'pull_request'
+        continue-on-error: true
+        env:
+          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
+          CF_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID || secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          set -u
+          if curl -sf -H "Authorization: Bearer $CF_API_TOKEN" \
+               "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT_ID/pages/projects" \
+               | grep -q '"success":true'; then
+            echo "Pages is readable with this token."
+          else
+            echo "::error title=CF_API_TOKEN has no Cloudflare Pages permission::The deploy below will fail with Authentication error 10000. This is NOT a wrong project name — the Pages list endpoint, which names no project, is refused as well, while Workers and zones both answer. Add 'Cloudflare Pages: Edit' to the org secret CF_API_TOKEN. The conduction-website project exists and serves www.conduction.nl."
+          fi
+
+      # Production publishing happens from `development` only. A
+      # workflow_dispatch on any other ref would otherwise push that branch
+      # straight to the production `main` alias below and replace
+      # www.conduction.nl with it.
+      - name: Deploy to Cloudflare Pages
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/development'
+        uses: cloudflare/wrangler-action@v3
+        with:
+          # The org secrets are CF_API_TOKEN / CF_ACCOUNT_ID. This step asked
+          # for CLOUDFLARE_API_TOKEN, which does not exist, so wrangler received
+          # an empty token and every deploy since ~15 Aug failed — while PR
+          # checks stayed green, because this step is skipped on pull_request.
+          # The repo-level CLOUDFLARE_ACCOUNT_ID is kept as a fallback so this
+          # keeps working if the org secret is ever scoped away.
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          accountId: ${{ secrets.CF_ACCOUNT_ID || secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: >-
+            pages deploy build
+            --project-name=conduction-website
+            --branch main
+            --commit-dirty=true

.github/workflows/validate-ai-baseline.yml

@@ -0,0 +1,55 @@
+name: AI baseline validation
+
+# Runs on every pull request so the AI-crawler baseline (robots.txt,
+# llms.txt, sitemaps, JSON-LD on the homepage and per-app pages,
+# FAQPage on /support /install /iso, og:image, twitter meta) is
+# re-asserted at PR time, not just after merge. The centralised
+# ConductionNL/.github documentation workflow only builds on push,
+# so without this job, validation regressions reach development.
+#
+# What runs: `npm run ci` -> `npm ci --legacy-peer-deps && npm run build`,
+# which triggers prebuild (app-downloads sync) + docusaurus build +
+# postbuild (scripts/validate-ai-baseline.mjs). Any of the 15 checks
+# failing exits non-zero and the workflow fails.
+#
+# The build is the same one production uses, so a green check here
+# also tells reviewers the site actually builds with their changes.
+
+on:
+  pull_request:
+    branches: [development, documentation]
+  workflow_dispatch:
+
+jobs:
+  validate:
+    name: Build and validate AI baseline
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies and build
+        env:
+          # Pass the run-scoped token to the prebuild script's
+          # app-downloads fetch so it stays under GitHub's 60-req/hr
+          # unauthenticated limit. The token is auto-scoped to this
+          # job and expires when it ends.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npm run ci
+
+      - name: Confirm validation gate ran
+        # `npm run ci` -> `npm run build` -> postbuild runs the
+        # 15-check validator and exits non-zero on regression. This
+        # extra step is a belt-and-braces guarantee: if anyone ever
+        # removes the postbuild hook from package.json by accident,
+        # the explicit invocation here still catches it at PR time.
+        run: node scripts/validate-ai-baseline.mjs

.gitignore

@@ -10,5 +10,25 @@ node_modules/
 # Misc
 .DS_Store
 *.log
+
+# Env
+.env
+.env.*
+!.env.example
 .env.local
 .env.*.local
+
+# Secrets / credentials — never commit
+*.pem
+*.key
+*_rsa
+*.crt
+
+__pycache__/
+
+# Playwright
+test-results/
+playwright-report/
+
+# Wrangler local cache — contains account identifiers, never committed.
+.wrangler/

.npmrc

@@ -2,4 +2,8 @@
 # 24h ago. Compromised first-party-Conduction packages are excluded via
 # Dependabot cooldown (.github/dependabot.yml); for fresh @conduction/*
 # releases, override per-install with `npm install --min-release-age=0`.
-min-release-age=1
+#
+# TEMPORARILY DISABLED 2026-05-22 to install @conduction/docusaurus-preset@3.20.0
+# (SetupSteps component) before its 24h cooldown elapsed. Re-enable tomorrow.
+# Tracking issue: ConductionNL/conduction-website#115 (re-enable tomorrow).
+# min-release-age=1

.nvmrc

@@ -0,0 +1 @@
+20