[Jay Gordon (jaydestro)]

Summary

Adds production-ready, human-gated gallery maintenance for AzureCosmosDB/gallery while keeping the site fully static:

• audits all live catalog entries and discovers bounded candidates from approved blogs, YouTube channels, GitHub organizations, and Microsoft Learn
• uses a tool-free GitHub Copilot CLI classification step with strict schema and authoritative-index validation
• requires the Azure Cosmos DB Agent Kit cosmosdb-best-practices skill and the repository humanizer skill
• runs automatically once a week, Monday at 06:17 UTC; manual dispatch remains available for setup and recovery
• rebuilds one draft maintenance proposal from current main; automation never merges or pushes to main
• supports deterministic Reject: A1, U1, R1 maintainer comments and revalidates each revised proposal
• requests review from jagord_microsoft only when a new maintenance PR is created
• excludes Azure DocumentDB content and records detailed proof for every proposed retirement
• publishes catalog cards newest-first without changing featured metadata
• rejects localized Microsoft documentation URLs such as /en-us/ in live and retired catalog records
• migrates dependency and Pages workflows from Yarn/PAT-based gh-pages publication to npm and official GitHub Pages artifact deployment

Documentation

• adds the architecture and implementation proposal
• adds the source eligibility, product scope, canonical URL, and retirement policy
• adds the operator runbook covering token creation, secret installation, permissions, skill setup, notification routing, first-run enablement, review commands, failure recovery, rollback, and Copilot CLI updates
• updates README and contributing guidance to describe the upstream URL, npm validation, and human review boundary

Required after merge

1. Create COPILOT_GITHUB_TOKEN

Use a maintained automation identity with an active GitHub Copilot subscription and permission to use Copilot CLI.

1. Open Settings > Developer settings > Personal access tokens > Fine-grained tokens > Generate new token.
2. Set Resource owner to the automation identity's personal account, not AzureCosmosDB.
3. Set Repository access to Public repositories.
4. Under Account permissions, add Copilot Requests only.
5. Set a policy-compliant expiration, generate the token, and copy the value immediately.

2. Create GALLERY_UPDATE_TOKEN

Use a maintained automation identity that is a member of AzureCosmosDB and can create branches and pull requests in this repository.

1. Create another fine-grained token.
2. Set Resource owner to AzureCosmosDB.
3. Set Repository access to Only select repositories > gallery.
4. Grant only Contents: Read and write and Pull requests: Read and write.
5. Set a policy-compliant expiration, generate the token, and copy the value immediately.
6. If the token is pending, an organization owner must approve it before the workflow can publish.

These must be separate tokens: Copilot Requests is a personal-account permission, while repository write access is organization-scoped.

3. Install the Actions secrets

In AzureCosmosDB/gallery > Settings > Secrets and variables > Actions > Secrets, add both values with these exact names:

• COPILOT_GITHUB_TOKEN
• GALLERY_UPDATE_TOKEN

Alternatively, use commands that prompt for each value without placing it in shell history:

gh secret set COPILOT_GITHUB_TOKEN --repo AzureCosmosDB/gallery
gh secret set GALLERY_UPDATE_TOKEN --repo AzureCosmosDB/gallery
gh secret list --repo AzureCosmosDB/gallery

Never paste token values into issues, pull requests, workflow inputs, command arguments, or logs.

4. Configure notification delivery

The workflow requests jagord_microsoft as reviewer only when it creates a new maintenance PR. In that account:

1. Verify jagord@microsoft.com under Settings > Emails.
2. Enable email delivery for participating and review-request notifications under Settings > Notifications.
3. Route AzureCosmosDB organization notifications to jagord@microsoft.com.
4. Confirm the first generated PR lists jagord_microsoft under Reviewers and that the email arrives.

No SMTP or mail-service secret is required.

5. Enable and verify workflows

1. Approve the pinned GitHub Actions used by the repository.
2. In Settings > Pages, change Build and deployment > Source from gh-pages to GitHub Actions.
3. Manually run Audit gallery content once. Confirm Copilot classification reports complete, both required skills pass preflight, and an eligible proposal can create or update the draft PR.
4. Review the first artifact and draft PR before relying on the weekly schedule.
5. Confirm a normal merge to main deploys https://azurecosmosdb.github.io/gallery/ through Deploy to GitHub Pages.

Validation

• npm ci
• npm run test:gallery-audit (62 passed)
• npm run gallery:audit:fixtures
• npm run build
• pinned Agent Kit download checksum and real Copilot CLI discovery of both required skills
• all workflow YAML parsed successfully
• exactly one automatic cron schedule
• no jaydestro or jaydestro.github.io references in automation, scripts, or documentation
• no localized Microsoft documentation URLs in live or retired catalogs
• no changes to static/templates.json; static/retired-templates.json is introduced as an empty infrastructure ledger
• no workflow can merge, enable automerge, or push directly to main

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical workflow and network-safety issues, plus validation and Markdown-injection issues, remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 3

Open (3)

• Temporary script copy omits required module dependencies · New
• Unspecified IPv6 address is not blocked by URL safety checks · New
• Authorization token leaks into public GitHub path requests · New

What changed in this PR

Adds human-gated automated gallery maintenance, content auditing, review workflows, and GitHub Pages deployment modernization.

Changes:

• Adds catalog auditing, discovery, classification, promotion, and rejection handling.
• Adds policies, skills, tests, documentation, and retirement tracking.
• Migrates deployment tooling from Yarn/gh-pages to npm and Pages artifacts.
• Updates gallery sorting and maintenance workflows.

File	Summary
static/​retired-templates.json	Adds retirement ledger.
src/​pages/​ShowcaseCardPage.tsx	Sorts gallery cards newest-first.
scripts/​gallery-audit/​test/​review-command.test.mjs	Adds review-command tests.
scripts/​gallery-audit/​test/​normalize.test.mjs	Adds normalization tests.
scripts/​gallery-audit/​test/​fixtures/​feed.xml	Adds feed fixture data.
scripts/​gallery-audit/​test/​configuration.test.mjs	Adds configuration tests.
scripts/​gallery-audit/​test/​audit.test.mjs	Adds audit tests.
scripts/​gallery-audit/​review-command.mjs	Handles review commands; title Markdown escaping is required.
scripts/​gallery-audit/​promotion.mjs	Promotes candidates; requires safe title rendering and same-host redirect validation.
scripts/​gallery-audit/​normalize.mjs	Normalizes catalog content.
scripts/​gallery-audit/​index.mjs	Provides audit entry point.
scripts/​gallery-audit/​core.mjs	Performs URL and network validation; IPv6 and authorization-boundary fixes are required.
scripts/​gallery-audit/​copilot.mjs	Classifies candidates; localized Learn URL validation is required.
README.md	Updates maintenance and validation guidance.
package.json	Adds npm scripts and dependencies.
package-lock.json	Records dependency lockfile updates.
docusaurus.config.js	Removes legacy deployment configuration.
docs/​gallery-content-discovery-and-maintenance-proposal.md	Documents architecture and implementation.
docs/​content-source-policy.md	Defines source and retirement policy.
docs/​automated-gallery-maintenance.md	Documents operation and recovery.
Contributing.md	Updates contributor guidance.
.gitignore	Ignores generated output and Yarn lockfiles.
.github/​workflows/​deploy.yml	Uses GitHub Pages artifact deployment.
.github/​workflows/​audit-gallery-content.yml	Adds scheduled auditing; secret conditional handling requires correction.
.github/​workflows/​apply-gallery-review.yml	Applies rejection commands; temporary script copying omits required dependencies.
.github/​skills/​humanizer/​SKILL.md	Adds humanizer guidance.
.github/​skills/​code-review/​SKILL.md	Adds review guidance.
.github/​gallery-audit/​sources.json	Defines approved sources.
.github/​gallery-audit/​relevance-prompt.md	Defines classification rubric.
.github/​gallery-audit/​policy.json	Defines audit and discovery policy.
.github/​agents/​gallery-curator.agent.md	Defines the constrained curator agent.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Jay Gordon (jaydestro)]

Sajeetharan (@sajeetharan) The Copilot review findings have been addressed and all threads are resolved. The current head passes 62 tests, fixture validation, the production build, YAML lint, and upstream CI. Please review, approve, and merge when ready. I will handle the required token setup after merge and reach out if I need organization-owner assistance.

[Sajeetharan (sajeetharan)]

The overall direction looks good. However, I’m requesting changes because a few safeguards need to be addressed before this is enabled:

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical and moderate findings affect redirect safety, catalog promotion, review parsing, workflow permissions, validation, and product-scope consistency.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 4 · 5

Open (9)

• Prevent unapproved redirect destinations from catalog promotion · New
• Require same-resource validation before promoting redirects · New
• Safely encode candidate data in review command markup · New
• Escape regenerated proposal metadata to prevent injection · New
• Grant permission to query collaborator authorization · New
• Make rerun branch names unique or handle existing PRs · New
• Check retired entries for URL conflicts · New
• Normalize redirected URLs before catalog updates · New
• Validate both catalogs before writing promotion results · New

Resolved since last review (3)

• Authorization token leaks into public GitHub path requests
• Unspecified IPv6 address is not blocked by URL safety checks
• Temporary script copy omits required module dependencies

[Jay Gordon (jaydestro)]

Sajeetharan (@sajeetharan) Your five requested safeguards have been addressed in b6878dc, including unique URL-based identity, GitHub rename/transfer handling, effective commenter permission checks, per-run maintenance PR branches, and enforced main approval protections.

A follow-up GitHub Copilot code review was run against those changes. All nine additional findings from that review were addressed in 01b73f3, with a specific response left on each thread. Local validation passes 71 tests, fixture discovery, and the production build.

This should now be ready to go. Please review the latest changes and approve for merge when satisfied. I do not have write permissions to main. I also will have to set up tokens in GitHub actions.