Major migration to ported pydata theme

.devcontainer/Dockerfile

@@ -0,0 +1,20 @@
+FROM python:3.14
+
+RUN apt update && apt upgrade -y && apt install vim -y
+
+# Add dev requirements
+#ADD requirements.txt /tmp/
+#RUN pip3 install -r /tmp/requirements.txt
+#RUN rm /tmp/requirements.txt
+
+# Install Hugo (extended). Version is pinned in .hugo-version at the repo
+# root — the same file .github/actions/setup-hugo reads in CI — so the
+# devcontainer and GitHub Actions never drift apart.
+COPY .hugo-version /tmp/.hugo-version
+RUN HUGO_VERSION="$(cat /tmp/.hugo-version)" \
+    && curl -fsSL "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb" -o /tmp/hugo.deb \
+    && apt-get install /tmp/hugo.deb -y \
+    && rm /tmp/hugo.deb /tmp/.hugo-version
+
+# Help avoid "unsupported locale setting" in Sphinx
+RUN echo "export LC_ALL=C.UTF-8" > ~/.bashrc

.devcontainer/devcontainer.json

@@ -0,0 +1,54 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+{
+	"name": "salt-project-website",
+
+	// README at: https://github.com/devcontainers/templates/tree/main/src/python
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	// Python container image is needed for running python-based tests (ex. orphaned-content.py)
+	// "image": "mcr.microsoft.com/devcontainers/python:3.13-bookworm",
+
+	"build": {
+		"dockerfile": "Dockerfile",
+		// Context is the repo root (not .devcontainer) so the Dockerfile can
+		// read the root .hugo-version file — the single source of truth for
+		// the Hugo version shared with GitHub Actions (see
+		// .github/actions/setup-hugo).
+		"context": ".."
+	},
+
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	// "features": {
+		// node / npm is required for markdownlint-cli2
+		// By default, installs lts version
+		// "ghcr.io/devcontainers/features/node:1": {}
+	// },
+
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	// "forwardPorts": [],
+
+	// Use 'postCreateCommand' to run commands after the container is created.
+	// "postCreateCommand": ""
+
+	// There is also a postStartCommand that executes every time the container starts.
+	// The parameters behave exactly like postCreateCommand, but the commands execute on start rather than create.
+	// "postStartCommand": ""
+
+	// There is also a postAttachCommand that executes every time the container attaches to a workspace.
+	// The parameters behave exactly like postCreateCommand, but the commands execute on a started container after the workspace is available under /workspaces/
+	// "postAttachCommand": {},
+
+	// Configure tool-specific properties.
+	"customizations": {
+		// Configure properties specific to VS Code.
+		"vscode": {
+			// Add the IDs of extensions you want installed when the container is created.
+			"extensions": [
+				// Extension to work with Python
+				"ms-python.python"
+			]
+		}
+	}
+
+	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+	// "remoteUser": "root"
+}

.devcontainer/requirements.txt

@@ -0,0 +1,2 @@
+nox>=2024.10.9
+pre-commit>=3.8.0

.github/actions/setup-hugo/action.yml

@@ -0,0 +1,39 @@
+name: Setup Hugo
+description: >-
+  Installs the Hugo extended CLI, using the version pinned in the repo's
+  root .hugo-version file — the same file the devcontainer reads, so CI and
+  local dev never drift apart. Pass `version` to override.
+
+inputs:
+  version:
+    description: >-
+      Hugo version to install (without the leading "v"). Defaults to the
+      version pinned in the repo's root .hugo-version file.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve Hugo version
+      id: resolve
+      shell: bash
+      run: |
+        version="${{ inputs.version }}"
+        if [ -z "$version" ]; then
+          version=$(cat .hugo-version)
+        fi
+        if [ -z "$version" ]; then
+          echo "::error::Could not resolve a Hugo version (no input given and .hugo-version is empty/missing)" >&2
+          exit 1
+        fi
+        echo "Using Hugo v${version}"
+        echo "version=${version}" >> "$GITHUB_OUTPUT"
+
+    - name: Install Hugo CLI
+      shell: bash
+      env:
+        HUGO_VERSION: ${{ steps.resolve.outputs.version }}
+      run: |
+        wget -O "${{ runner.temp }}/hugo.deb" "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb" \
+        && sudo dpkg -i "${{ runner.temp }}/hugo.deb"

.github/workflows/gh-pages.yml

@@ -1,21 +1,30 @@
-# Workflow for building and deploying a Hugo site to GitHub Pages
+# Workflow for building and deploying a Hugo site to GitHub Pages.
+#
+# SECURITY: this workflow must never trigger on `pull_request`. It requests
+# `pages: write` / `id-token: write`, and for `pull_request` (as opposed to
+# `pull_request_target`) GitHub runs the workflow definition from the PR's
+# own branch — for a same-repo (non-fork) branch, GitHub does NOT downgrade
+# the token, so an attacker-controlled branch could edit this file to abuse
+# those permissions on their own PR. Deploy credentials must stay confined
+# to push/tag/dispatch events on this repo, which require write access to
+# push in the first place. PR-time checks (build + tag validation) live in
+# the separate pr-checks.yml, which only ever requests `contents: read`.
 name: Deploy Hugo site to Pages
 
 on:
   push:
     branches:
-      - '*'
+      - main
     tags:
       - 'v**'
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+# Default (minimal) permissions for the whole workflow. `build` and `deploy`
+# below are each granted the extra permissions they individually need.
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
 # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
@@ -29,18 +38,17 @@ defaults:
     shell: bash
 
 jobs:
-  # Build job
+  # Build job. Needs `pages: write` because actions/configure-pages calls
+  # the Pages API to resolve the configured custom domain's base_url.
   build:
+    permissions:
+      pages: write
     runs-on: ubuntu-24.04
-    env:
-      HUGO_VERSION: 0.135.0
     steps:
-      - name: Install Hugo CLI
-        run: |
-          wget -O ${{ runner.temp }}/hugo.deb https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb \
-          && sudo dpkg -i ${{ runner.temp }}/hugo.deb
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Install Hugo CLI
+        uses: ./.github/actions/setup-hugo
       - name: Setup Pages
         id: pages
         uses: actions/configure-pages@v5
@@ -52,18 +60,40 @@ jobs:
           hugo \
             --minify \
             --baseURL "${{ steps.pages.outputs.base_url }}/"
+      - name: Duplicate security feed to legacy URL
+        run: scripts/duplicate-security-feed.sh
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v3
         with:
           path: ./public
 
-  # Deployment job
+  # Tag validation job — a safety net for tags pushed directly, bypassing PR
+  # checks entirely.
+  validate-tags:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.14"
+      - name: Validate blog post tags
+        run: python3 scripts/validate-tags.py
+
+  # Deployment job — only runs when pushing a version tag. This is the only
+  # job that needs (and is granted) Pages/OIDC write access.
   deploy:
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-24.04
-    needs: build
+    needs:
+      - build
+      - validate-tags
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/pr-checks.yml

@@ -0,0 +1,45 @@
+# Workflow to sanity-check pull requests: the site must build cleanly with
+# Hugo, and blog post tags must stick to the approved taxonomy.
+#
+# SECURITY: this workflow only ever requests `contents: read` and must never
+# be given `pages`/`id-token` write permissions — see the note at the top of
+# gh-pages.yml for why that combination is dangerous on a `pull_request`
+# trigger. Deploy credentials live only in gh-pages.yml, which never
+# triggers on pull_request.
+name: PR checks
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+# Default to bash
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Install Hugo CLI
+        uses: ./.github/actions/setup-hugo
+      - name: Build with Hugo
+        env:
+          HUGO_CACHEDIR: ${{ runner.temp }}/hugo_cache
+        run: hugo --minify
+
+  validate-tags:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.14"
+      - name: Validate blog post tags
+        run: python3 scripts/validate-tags.py

.gitignore

@@ -1,4 +1,3 @@
-themes/
 public/
 .hugo_build.lock
 venv
@@ -9,3 +8,9 @@ static/.DS_Store
 static/images/.DS_Store
 *.un~
 .idea
+*.bkup
+*.bak
+.env
+.env.*
+*.pem
+*.key

.hugo-version

@@ -0,0 +1 @@
+0.162.1