Site updates for v26.7.1: release post, FAQ coverage, broken link fixes - #118
Merged
Merged
Conversation
Drafts the release post for v26.7.1, following the house pattern for release announcements (byline Viktor Petersson, "The One That ..." title, TL;DR block, per-theme sections, Getting Started). Leads on VEX, which is the substantive change in this release: three formats, in-product triage, Dependency-Track sync, and scheduled drift detection. Then CBOM ingestion breadth (framed as closing the gap left by v26.7.0), Trust Center exposure, and the vulnerability-count posture fix, which is called out separately because users will see their totals drop. Left as `draft: true` so merging does not publish it before it has been reviewed -- delete that line to ship. Verified: dprint clean, Hugo builds, and every internal link resolves (previous release post, /features/ trust-center/, /authors/vpetersson/, all tag pages). (cherry picked from commit 0fd7024)
Found by a site-wide link audit of the built output (331 pages). All three predate this change and 404 today: - posts/2026-01-23-...-attestations.md used a /blog/ prefix for a post permalink; the permalink format is /:year/:month/:day/:title/ - compliance/fda-medical-device.md linked /blog/fda-medical-device-sbom- requirements/ instead of the post's dated permalink - faq/why-do-i-need-an-sbom.md linked /compliance/fda/, which does not exist; the page is /compliance/fda-medical-device/ Verified: dprint clean, Hugo builds, and a re-run of the audit reports zero broken internal links across the site. (cherry picked from commit bf5f861)
Audited the FAQ against the v26.7.1 release notes. Most of the release was already covered -- VEX formats, Dependency-Track sync, Trust Center VEX and CBOM exposure, and the CycloneDX/SPDX version claims all matched the code. Three gaps remained. how-do-i-use-vex.md Scheduled drift detection was documented nowhere on the site. Adds a "Keeping your statements current" section covering stale statements and uncovered High/Critical findings, and explains why a stale not_affected is worse than no VEX. Also marks the Dependency-Track sync as opt-in, which the previous wording did not say. what-is-a-cbom.md Ingestion previously depended on which generator produced the CBOM. Notes that every lineage now ingests and that assets are normalized against the CycloneDX 1.7 crypto registry, plus the new workspace-level crypto posture. how-does-sbomify-count-vulnerabilities.md (new, weight 69) Counts now reflect current posture rather than a sum over every historical SBOM version, so totals drop on upgrade. That reads like a bug without an explanation, and support will be asked. Also documents what a count includes, VEX suppression, and why release-scoped counts are pinned to the artifacts actually shipped. Verified: dprint clean, Hugo builds, new FAQ renders and appears in the FAQ index, and all internal links in the changed pages resolve. (cherry picked from commit 7158727)
This was referenced Jul 30, 2026
Hugo Build Check has been failing on every branch since ~10:45 today,
including master, with:
install: cannot create regular file
'/usr/local/share/man/man1/d2.1': Permission denied
make: *** [Makefile:11: install] Error 1
The `Install d2` step pipes https://d2lang.com/install.sh into sh. That
script runs `make install`, which installs a man page into
/usr/local/share/man/man1 -- a path the GitHub runner user cannot write.
Nothing in this repository changed to cause it; two branches that ran
before 10:45 passed with identical workflow files, and master fails the
same way without any of this branch's content.
Download the pinned release tarball and install just the binary into
~/.local/bin, added to GITHUB_PATH. No make, no man page, no sudo. The
version and a sha256 of the artifact are pinned, so the step also stops
depending on whatever an unversioned remote script does next -- relevant
for a repo running Scorecard.
Applied to all three occurrences: lint.yml (lint, hugo-build) and
deploy.yml (deploy).
Verified: both workflows parse, and the step was dry-run end to end
locally -- checksum verifies and `d2 --version` reports v0.7.1 with no
elevated permissions.
vpetersson
pushed a commit
that referenced
this pull request
Jul 30, 2026
Removes draft: true from the v26.7.1 post. The flag was set intentionally in #118 so that merging would not publish the post before the copy had been reviewed, on the assumption it would be removed as a separate step. That step was missed, so the post has been on master since 12:55 without appearing on the site: Hugo excludes drafts from production builds, and only the nightly/deploy build with --buildDrafts would have picked it up. Verified with a clean production build (no --buildDrafts): the post renders, and appears in the blog index, the RSS feed, the sitemap, and on the homepage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Everything from the v26.7.1 site pass, in one PR. Supersedes #115, #116 and #117, which I am closing in favour of this. Three commits kept separate so they can still be reviewed independently.
1.
Add v26.7.1 release announcement postDraft post for v26.7.1: "The One That Says "Not Affected"", following the house pattern from the previous three release posts (Viktor Petersson byline, TL;DR block, per-theme sections separated by rules, hosted/self-hosted Getting Started).
VEX leads, with the "why before what" treatment the v26.7.0 post gave CBOM. Then CBOM ingestion breadth (framed as closing the gap that release left, linking back to it), Trust Center exposure, the count fix, design refresh, API/security, and a short under-the-hood note.
One editorial call: the vulnerability-count fix gets its own section, because users will see totals drop and that reads like a bug otherwise. The post is explicit that nothing was fixed by the change itself — the number is simply accurate now.
draft: trueis set, so merging will not publish it. Delete that line to ship.2.
Fix three broken internal linksFound by auditing every
hrefin the built output. All three 404 today and predate this work:posts/2026-01-23-…-attestations.md/blog/2026/01/20/announcing-sbomify-action-v0-11-…//blog/prefixcompliance/fda-medical-device.md/blog/fda-medical-device-sbom-requirements//2026/01/09/fda-medical-device-sbom-requirements/faq/why-do-i-need-an-sbom.md/compliance/fda//compliance/fda-medical-device/The first two use a
/blog/prefix that is not the permalink format (/:year/:month/:day/:title/). The third points at a page that does not exist.3.
FAQ: cover the v26.7.1 featuresI audited all 28 FAQ pages against the release notes, and most of the release was already covered — VEX formats, Dependency-Track sync, Trust Center VEX/CBOM exposure, and the format-version claims were all accurate. I checked the format claims against source (
cyclonedx_validator.py:59lists exactly 1.3–1.7, with matching shipped schemas) rather than trusting the page. No stale references to the Project layer removed in v26.3.0 either.Three gaps:
grep -rli "drift"returned nothing outside posts). New Keeping your statements current section inhow-do-i-use-vex.md. Also marked the Dependency-Track sync opt-in — the old wording implied it was automatic.what-is-a-cbom.mdnow notes every lineage ingests, CycloneDX 1.7 crypto-registry normalization, and the workspace-level crypto posture.Verification
bun run lint:markdowncleanhugo --minify --environment production --buildDraftsbuilds, 332 pagesTwo notes
Commits are authored by
vpetersson-bot, not Viktor. The post byline is Viktor Petersson as requested, but I did not forge git authorship. Amend if you would rather it be attributed to you.Not included, deliberately: workspace-scoped token binding and the component-SBOMs list version/format filtering are real v26.7.1 changes, but they are API-surface details with no existing FAQ home — the in-app API docs look like the better place. Happy to add FAQ entries if you disagree.
Separately, CI runs lychee in
lint.ymlbut those three broken links survived it. Worth confirming lychee actually resolves relative internal links, otherwise this class of breakage stays invisible.