[Katrien De Graeve (katriendg)]

Description

Updated docusaurus-tests.yml with persist-credentials: false to address the checkout-credential requirement in #859. All other workflow configuration is unchanged.

The branch also took in dependency vulnerability fixes after the failed security checks on #884 exposed repository-wide blockers. These updates address fixable findings needed for CI to pass; final validation remains with CI, and the upstream Zod finding is still unresolved.

Related Issue

Relates to #859. This PR addresses the Docusaurus checkout-credential gap only; it does not complete the Merge Queue rollout or close the issue.

Related CI failure: #884.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Blueprint modification or addition
• Component modification or addition
• Documentation update
• CI/CD pipeline change
• Other (please describe): Dependency security updates and Dependabot consolidation

Implementation Details

• Disabled credential persistence on the existing Docusaurus test checkout without changing its action pin, triggers, permissions, or other workflow settings.
• Updated Tokio to 1.54.1 across ten affected Rust lockfiles to address RUSTSEC-2026-0386.
• Updated affected npm dependency constraints and lockfiles for body-parser, undici, fast-uri, ip-address, and serialize-javascript.
• Updated MSAL Node to 7.1.1 and aligned the Azure Identity transitive dependency with that patched version.
• Consolidated the Microsoft Graph Go SDK update from chore(deps): bump github.com/microsoftgraph/msgraph-sdk-go from 1.104.0 to 1.105.0 in /blueprints/full-multi-node-cluster/tests in the gomod group across 1 directory #906, the Vitest updates from chore(deps): bump @vitest/mocker, @vitest/coverage-v8 and vitest in /src/500-application/516-chat-with-your-factory/services/chat-with-your-factory #904, and the certifi update from chore(deps): bump the pip group across 1 directory with 2 updates #905.
• Retained the existing security thresholds and advisory policy.

Testing Performed

• Terraform plan/apply

• Blueprint deployment test

• Unit tests

• Integration tests

• Bug fix includes regression test (see Test Policy)

• Manual validation

• Other: Rust dependency audits, chat server compilation, Go module verification, workflow permission validation, and patch hygiene

• All 22 Rust lockfiles passed cargo audit --deny warnings with the repository's existing advisory and yanked-package policy.

• The chat server TypeScript build and all 38 tests passed after the MSAL update, before the final Vitest patch update. CI must validate the final locked test-tool versions.

• go mod verify passed for the updated Microsoft Graph dependency.

• Workflow permission validation passed for all 38 scanned workflows.

• git diff --check origin/main...HEAD passed.

• Full builds, Go vulnerability analysis, browser and deployment tests, and final security scans remain for CI.

Validation Steps

1. Confirm the only workflow change is persist-credentials: false on the Docusaurus test checkout.
2. Verify Docusaurus tests, dependency review, Cargo Audit, and Security Scan results on the final branch commit.
3. Confirm the chat application builds and its tests pass with the final npm lockfile.
4. Keep feat(workflows): enable GitHub Merge Queue with merge-group CI validation #859 open for the remaining trust gates, hosted activation, and live Merge Queue proof.

Checklist

• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have run terraform fmt on all Terraform code
• I have run terraform validate on all Terraform code
• I have run az bicep format on all Bicep code
• I have run az bicep build to validate all Bicep code
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Security Review

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles
• No new network exposure or public endpoints introduced without justification
• Dependency additions or updates have been reviewed for known vulnerabilities
• Container image changes use pinned digests or SHA references

Additional Notes

• Zod remains a known security-scan blocker because the upstream Agents SDK requires v3. A forced v4 override was not applied because its schema API is incompatible.
• The Checkov portion of chore(deps): bump the pip group across 1 directory with 2 updates #905 was not included because it introduces ecdsa, which has an unpatched high-severity advisory.
• No security checks were disabled, and these changes do not assert that hosted CI has passed.

Screenshots (if applicable)

Not applicable.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 48.43%. Comparing base (b1c77da) to head (5101ccb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #907   +/-   ##
=======================================
  Coverage   48.43%   48.43%           
=======================================
  Files          45       45           
  Lines        8516     8516           
=======================================
  Hits         4125     4125           
  Misses       4391     4391           

Flag	Coverage Δ
rust	48.43% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

📚 Documentation Health Report

Generated on: 2026-10-27 10:30:01 UTC

📈 Documentation Statistics

Category	File Count
Main Documentation	224
Infrastructure Components	238
Blueprints	40
GitHub Resources	26
AI Assistant Guides (Copilot)	17
Total	545

🏗️ Three-Tree Architecture Status

• ✅ Bicep Documentation Tree: Auto-generated navigation
• ✅ Terraform Documentation Tree: Auto-generated navigation
• ✅ README Documentation Tree: Manual README organization

🔍 Quality Metrics

• Frontmatter Validation:
  success
• Link Validation: success

---

This report is automatically generated by the Documentation Automation workflow.

[github-actions]

📚 Documentation Health Report

Generated on: 2026-10-27 10:36:34 UTC

📈 Documentation Statistics

Category	File Count
Main Documentation	224
Infrastructure Components	238
Blueprints	40
GitHub Resources	26
AI Assistant Guides (Copilot)	17
Total	545

🏗️ Three-Tree Architecture Status

• ✅ Bicep Documentation Tree: Auto-generated navigation
• ✅ Terraform Documentation Tree: Auto-generated navigation
• ✅ README Documentation Tree: Manual README organization

🔍 Quality Metrics

• Frontmatter Validation:
  success
• Link Validation: success

---

This report is automatically generated by the Documentation Automation workflow.

[github-actions]

📚 Documentation Health Report

Generated on: 2026-10-27 10:42:40 UTC

📈 Documentation Statistics

Category	File Count
Main Documentation	224
Infrastructure Components	238
Blueprints	40
GitHub Resources	26
AI Assistant Guides (Copilot)	17
Total	545

🏗️ Three-Tree Architecture Status

• ✅ Bicep Documentation Tree: Auto-generated navigation
• ✅ Terraform Documentation Tree: Auto-generated navigation
• ✅ README Documentation Tree: Manual README organization

🔍 Quality Metrics

• Frontmatter Validation:
  success
• Link Validation: success

---

This report is automatically generated by the Documentation Automation workflow.

[github-actions]

📚 Documentation Health Report

Generated on: 2026-10-27 11:45:24 UTC

📈 Documentation Statistics

Category	File Count
Main Documentation	224
Infrastructure Components	238
Blueprints	40
GitHub Resources	26
AI Assistant Guides (Copilot)	17
Total	545

🏗️ Three-Tree Architecture Status

• ✅ Bicep Documentation Tree: Auto-generated navigation
• ✅ Terraform Documentation Tree: Auto-generated navigation
• ✅ README Documentation Tree: Manual README organization

🔍 Quality Metrics

• Frontmatter Validation:
  success
• Link Validation: success

---

This report is automatically generated by the Documentation Automation workflow.