Merge main into release136 - #1680
Merged
Merged
Conversation
* Keep docs versions current and default to TypeScript Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address TypeScript-first review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix: merge duplicate C#/.NET sidebar sections under Frameworks & runtimes * Clean:revert unrelated icon safelist regeneration * fix: match sidebar label to page title for .NET get-started item
* Claude's accessibility fixes. * Addressed list margins feedback from @Copilot.
* chore: Update integration data and GitHub stats (9/9/26) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: keep integration documentation mappings synchronized Remove the stale Bun mapping, reconcile catalog-managed mappings during updates, and stage documentation-map changes in automated PRs. Validate structured data without Astro-generated asset side effects. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: David Pine <david.pine@microsoft.com>
* docs: restore Floci integration documentation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: address Floci review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* feat: improve search and agent discoverability Restore page-specific descriptions, publish useful homepage Markdown, strengthen observability guidance, and defer inactive AppHost examples. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: keep mobile homepage within layout budget Tighten spacing in the expanded observability section so the production mobile viewport remains within the existing compactness gate. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: align agent docs and search indexing Document authenticated standalone MCP with an explicit API key and keep deferred AppHost examples out of the homepage Pagefind index. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Extensions.Hosting from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Instrumentation.Http from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Instrumentation.Runtime from 1.17.0 to 1.18.0 --- updated-dependencies: - dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-selected - dependency-name: OpenTelemetry.Extensions.Hosting dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-selected - dependency-name: OpenTelemetry.Instrumentation.AspNetCore dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-selected - dependency-name: OpenTelemetry.Instrumentation.Http dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-selected - dependency-name: OpenTelemetry.Instrumentation.Runtime dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-selected ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…updates (#1601) Bumps the github-actions group with 2 updates in the / directory: [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) and [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions). Updates `github/gh-aw-actions/setup` from 0.87.1 to 0.88.0 - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](github/gh-aw-actions@423b3dc...afc709f) Updates `github/gh-aw-actions/setup-cli` from 0.87.1 to 0.88.0 - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](github/gh-aw-actions@423b3dc...afc709f) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.87.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.87.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix right TOC width at browser zoom levels Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Hide right TOC when mobile TOC is visible Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…AIFoundry references (#1163) * docs: clarify Foundry migration guidance Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: update Foundry package versions Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b8ebe88c-337e-4d4a-aa80-e14c2c76289b --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Maddy Montaquila <maddy@MadBook-Pro-20.local> Copilot-Session: b8ebe88c-337e-4d4a-aa80-e14c2c76289b
…ck annotation references (#1158) * Update deployment docs to pipeline-step API Refresh custom deployment examples for pipeline steps and clarify legacy callback references in deployment, diagnostics, and release notes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5b0c81a3-d822-462e-8cf5-8eb6debfe968 * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Restore historical What's new content Keep release-version articles unchanged while retaining the current pipeline API updates elsewhere. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address deployment docs review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b156fe61-0b1c-460c-9735-1eaeaa356b0a * Align Aspire 9.4 deployment example with pipelines Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b156fe61-0b1c-460c-9735-1eaeaa356b0a --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: David Pine <david.pine@microsoft.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Maddy Montaquila <maddy@MadBook-Pro-20.local> Copilot-Session: 5b0c81a3-d822-462e-8cf5-8eb6debfe968 Copilot-Session: b156fe61-0b1c-460c-9735-1eaeaa356b0a
* Add live-status header icon, SSE backend, redesigned videos page
- Adds a strobing live-status indicator in the site header (left of the
cookie-preferences button) wired to a new /api/live SSE endpoint.
- Adds a custom floating PiP player that follows visitors across the
site while live and returns them to the videos page on close.
- Replaces the legacy curated /community/videos/ page with a focused
YouTube + Twitch tabbed page whose embed lights up when live.
- Adds an in-StaticHost background-worker stack:
* Twitch EventSub stream.online/offline subscription + reconcile,
* YouTube WebSub subscribe/renew + confirming poll fallback,
* a debounced LiveStatusBroadcaster with sticky primary-source
mesh logic and Channel<T> SSE fan-out.
- Surfaces the new endpoints + Scalar API reference (with a custom
Aspire-brand theme) on the Aspire dashboard for local dev.
- Includes a worktree cleanup helper script and PR_BODY.md.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add tests for live-status feature
- StaticHost.Tests xUnit project: TwitchWebhookHandler (HMAC-SHA256
round-trip + tamper detection), YouTubeWebhookHandler (HMAC-SHA1 +
Atom video-id extraction), LiveStatusBroadcaster (sticky-primary
mesh, coalesce window via FakeTimeProvider, subscribe/unsubscribe).
- vitest spec for live-status.ts public API.
- Playwright spec mocking /api/live + a controllable SSE stream to
drive the header icon strobe and the floating PiP open/close UX.
22 backend xUnit tests + 3 vitest assertions all green locally.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Unwrap draft PR body
Remove hard-wrapped prose from the draft PR description so GitHub renders paragraphs and list items without arbitrary line breaks.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Remove draft PR body file
Do not keep the temporary GitHub PR description file in source control.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Remove worktree cleanup scripts
The cleanup helpers were workflow-only artifacts and should not be source controlled.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add local live-status dev controls
- Enable an explicit AppHost local dev mode for live-status testing.
- Add dashboard HTTP commands on the StaticHost resource to fake Twitch
and YouTube live events, including signed calls to the real webhook
endpoints.
- Keep provider workers idle when API credentials are absent so local
state only changes when commanded.
- Fix the live-status JSON contract to emit youtube, matching the
frontend client, and add coverage for that shape.
- Document dashboard-command and manual HTTP testing paths.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Secure live dev commands and native PiP
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Keep live PiP open across navigation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Build frontend directly into StaticHost
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Keep live PiP alive across site navigation
Enable Astro client routing so same-origin site links swap content without unloading the opener document that owns the native Document Picture-in-Picture window. Update the live-status e2e coverage to click a real internal Docs link and assert the PiP iframe remains intact.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Let users choose live PiP source
When both Twitch and YouTube are live, show an explicit live-source menu from the header action before opening native Picture-in-Picture. Keep the selected source sticky while it remains live and allow switching an existing PiP window without recreating it.
Also replace noisy iframe title attributes on the live embeds with aria-labels so the videos tabs keep an accessible frame name without hover title noise.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Polish live stream chooser
Add YouTube and Twitch icons to the live-source chooser and remove the redundant aspiredotdev helper text. Rename the Community sidebar entry and related live destination copy from videos to Live Streams.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix live UX navigation regressions
Preserve the cookie consent root across Astro client-side body swaps so preferences continue to open after navigation. Restyle the live source chooser to align with the existing install modal treatment and cover the cookie regression with Playwright.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add live stream action dialog
Always show the live chooser while live so users can pick native PiP, the aspire.dev embeds, or the provider platform directly. Add a session-scoped dismiss action that silences the strobing live notification for the current live event without hiding the live entry point.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix live dialog mobile layout
Keep the live action dialog within narrow viewports and add mobile E2E coverage using mocked live status APIs. Also keep generated StaticHost output out of Debug build item discovery so local AppHost starts remain fast.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Polish live dialog responsive behavior
Make repeated live icon clicks toggle the live dialog, render the mobile dialog as a stable full-width sheet, restore a wider desktop menu with one-line labels, and harden mocked live-status E2E coverage for both layouts.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Move mobile live dialog below header
Anchor the mobile live action dialog below the top navigation instead of using a bottom sheet, add a top-right dismiss button matching the Install CLI modal affordance, and update E2E coverage for placement and dismiss behavior.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Polish live actions and notification sessions
Use regular Fluent icon names for local live command actions, reorganize the live action dialog into PiP, embedded-player, and platform groups, add external-link affordances, and introduce a stable liveSessionId so dismissing a live notification covers near-simultaneous provider joins.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix compact header regression expectation
Account for the live status header action in the compact header reachability test and map it by tour target so the assertion remains stable when live-state labels change.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add StaticHost live unit coverage
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address live status PR feedback
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* * PR feedback
* fixup
* Fix API reference search controllers under view transitions
The six API reference page templates initialized their search controllers
inside a `DOMContentLoaded` listener. After this branch adds the
`<ClientRouter />` to `Head.astro` (so the live PiP can persist
across navigation), the site swaps bodies via view transitions and
`DOMContentLoaded` does not refire on subsequent navigations. As a
result, clicking the C#/TypeScript API buttons from the global search
dialog landed on the API page with the URL `?q=` parameter in place but
the controller was never instantiated, so `#ts-api-search-input` (and
its C# counterpart) was never populated and search results were never
rendered.
Switch all six API reference page initializers to `astro:page-load`,
which fires on the initial load and after every view-transition swap.
This matches the convention already used by `Sidebar.astro`,
`PageTitle.astro`, `InstallCliModal.astro`, and the rest of the
post-ClientRouter components in this branch.
Resolves:
tests/e2e/site-search.spec.ts:200 'typed query is forwarded to the
C# and TypeScript API buttons' (desktop / tablet / mobile chromium).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback for live-status
Backend (StaticHost):
- Broadcaster: seed+register subscribers atomically under the lock so a flush
landing mid-subscribe can't strand a client on the stale seed; resolve sticky
primary against the pending basis so the first source stays primary when a
second joins within the coalesce window; ignore UpdatedAt when deciding whether
anything substantive changed so an ever-advancing timestamp can't force a
redundant broadcast.
- Twitch webhook: reject stale/unparseable Message-Timestamp (10-min window, 1-min
future skew) to bound replay of genuinely-signed callbacks; skip message-id dedup
for verification handshakes so retried challenges always echo; inject TimeProvider.
- YouTube webhook: replace the untracked per-notification Task.Run with a bounded,
coalescing YouTubeLiveConfirmationQueue BackgroundService (capacity-1 DropWrite)
tied to the host stopping token.
- Reconcile loops: only swallow OperationCanceledException when the stopping token
actually fired, so genuine cancellations elsewhere still surface.
- Cache-Control: no-store now applied centrally to the whole /api/live group via an
endpoint filter instead of per-handler.
Frontend:
- Seed fetch no longer clobbers fresher SSE state (apply only when not older).
- Tabs: only trusted (real user) clicks make a tab sticky, so auto-switch keeps
working; synthetic activateTab() clicks are ignored.
- build-static-host: restore scalar/.gitignore in finally before the temp dir is
removed, so a failed astro build can't lose the only preserved copies.
- Dev proxy: AppHost injects StaticHost's origin (ASPIRE_STATICHOST_URL) and Vite
proxies /api/live[/stream] to it under `aspire run`; omitted in CI/prod.
- Playwright: fulfil the SSE route with a complete string body via a shared helper
instead of a ReadableStream that serialised to garbage.
Tests:
- Broadcaster: coalesce-window primary stickiness and no-op suppression regressions.
- TwitchWebhookHandler.IsFresh: fresh/stale/skew/unparseable.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix botched merge in Header.astro cookie consent
The merge left Header.astro importing the removed `vanilla-cookieconsent`
package, breaking the frontend build. upstream/main replaced that package
with a global `[data-cookie-manage-consent]` handler in Head.astro
(`siteConsent.manageConsent()`), so drop the stale import and script and
keep only the live-status wiring.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add seoTitle to videos page to satisfy SEO length guard
The redesigned videos page composed an og:title of only 23 characters
("Aspire Live 📺 · Aspire"), below the 30-65 guard range enforced by
tests/unit/seo-lengths.vitest.test.ts. Add a verbatim `seoTitle`
override (55 chars, in the 50-60 optimal range) so the social-card title
stays keyword-rich without lengthening the visible page title.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Remove obsolete cookie-preferences SPA-nav e2e test
This PR-only test leaked into the merge without its `openCookiePreferences`
helper, causing a ReferenceError across all e2e shards. The helper asserted
the `#pm__title` vanilla-cookieconsent modal, but upstream/main removed that
library in favor of a global `[data-cookie-manage-consent]` delegated
listener (Head.astro) that survives client-side navigation by design. The new
mechanism is already covered by cookie-consent.spec.ts, so drop the stale test.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden live status production readiness
Back production stream settings with Azure Key Vault, make YouTube polling and WebSub quota-safe, and repair local proxy, client-navigation lifecycle, static asset, and autoplay behavior.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Ignore generated Aspire publish output
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Prefer provider handoff for mobile live streams
Keep Document Picture-in-Picture on desktop while touch-first devices use provider apps or the existing iframe page. Improve chooser focus, failure feedback, touch targets, and iframe permissions.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Update live command tests for Aspire 13.5
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Use read-only site secrets and reduce live-status overhead
Provision a shared siteconfig vault without secret values, preserve read-only references, reuse SSE frames and timers, and avoid redundant player and navigation work.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Use parameters for live configuration
Keep non-sensitive live-status settings as deployment parameters while retaining provider credentials and webhook signing keys as read-only Key Vault references.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Update ASP.NET Core OpenAPI package
Use Microsoft.AspNetCore.OpenApi 10.0.12 so StaticHost resolves a current, non-vulnerable Microsoft.OpenApi dependency.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Isolate live status scaling
Keep the public StaticHost on Aspire's normal per-site worker ceiling and proxy live-status traffic to a dedicated single-worker coordinator.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Use Redis for distributed live status
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Rename live cache variable
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Load live secrets from Key Vault configuration
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address live status review feedback
Use direct Redis optimistic concurrency for shared records, require distributed production services, clarify resource names and startup behavior, and share frontend brand tokens with Scalar.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Remove Redis key versions
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address live status review feedback and coverage gaps
Preserve consent and API search ownership across navigation, fence YouTube observations, make WebSub retries idempotent, and refresh rejected Twitch tokens. Add mapped HTTP, Redis, and accessibility coverage and run backend suites in CI.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Use Aspire to manage Redis integration test infrastructure
Create the Redis-only application with DistributedApplicationTestingBuilder and the same Azure Managed Redis hosting integration as the AppHost. Remove the separate CI image pin, external connection-string contract, and shared-instance ownership guards.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix live embeds on staging and show YouTube uploads offline
Resolve Twitch parent from the browser hostname before loading, correct the shared Aspire YouTube channel, and switch between the non-autoplaying uploads playlist and exact live video. Cover source transitions, hidden tabs, and client navigation.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Eric Erhardt <eric.erhardt@microsoft.com>
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
* docs: recreate language-neutral dev container guides Recreates #1627, including the certificate trust clarification and refreshed template screenshots. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: remove unnecessary SDK aside from container guides Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Clears all open Dependabot alerts for src/frontend (1 critical, 6 high, 5 medium): - astro 7.1.3 -> 7.2.10 (critical GHSA + medium) - sharp 0.35.3 -> 0.35.4 (high) - vitest 4.1.10 -> 4.1.11; @vitest/mocker -> 4.1.11 (medium) - pnpm overrides: js-yaml 4.3.2, nanoid 3.3.18, svgo 4.1.0, fflate 0.7.5, smol-toml 1.7.1 Verified: pnpm install OK; pnpm audit -> no known vulnerabilities; astro sync OK. Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* fix: restore site search after client-side navigation Initialize Pagefind per connected search element and dispose stale listeners and UI instances when navigating. Add navigation, history, API-page, and delayed-import regressions. Fixes #1673 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: preserve Mermaid layout across client navigation Keep Mermaid centering and responsive SVG sizing in the bundled stylesheet rather than relying on the plugin's one-time injected head style. Cover repeated navigation in light and dark themes on desktop and mobile. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: keep two-slash hover popups paired across navigation Replace competing plugin and inline hover initializers with one site-owned runtime that pairs each token with its generated popup and initializes each new page idempotently. Preserve rendered hover styles and Expressive Code tools. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: restore filters and history across client navigation Reinitialize API version, integration, and sample filters for each page and dispose outgoing listeners and debounce timers. Preserve Astro history state when filtering and avoid adding history entries during gallery initialization. Cover repeated navigation and Back on desktop and mobile. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test: use the touch navigation fallback for site search Match the existing client-navigation suites by exercising native view transitions on desktop and ClientRouter's supported swap fallback on mobile and tablet. This prevents Chromium touch-emulation transition-abort exceptions from failing the strict search error assertions. Preserve all input, results, focus, history, and page-error checks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Eric Erhardt (eerhardt)
requested review from
David Pine (IEvangelist),
James Newton-King (JamesNK) and
Aaron Powell (aaronpowell)
as code owners
September 16, 2026 14:28
Copilot started reviewing on behalf of
Eric Erhardt (eerhardt)
September 16, 2026 14:28
View session
Remove Microsoft mirror URL overrides while preserving pinned versions and integrity hashes so CI passes pnpm supply-chain checks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Critical frontend configuration and custom-element lifecycle issues, plus additional correctness findings, remain unresolved.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Merges main into release136, adding live-stream infrastructure, frontend lifecycle updates, documentation changes, and expanded testing.
Changes:
- Adds Redis-backed Twitch/YouTube live-status tracking, webhooks, SSE, and AppHost wiring.
- Adds live embeds, header controls, and navigation-aware frontend behavior.
- Updates documentation, integrations, dependencies, tests, and CI workflows.
File summaries
| File | Description |
|---|---|
tests/StaticHost.Tests/StaticHost.Tests.csproj |
Adds Aspire testing dependencies. |
tests/StaticHost.Tests/Live/YouTubeWebSubRetryTests.cs |
Tests WebSub retry behavior. |
tests/StaticHost.Tests/Live/YouTubeWebhookHandlerTests.cs |
Tests YouTube webhook helpers. |
tests/StaticHost.Tests/Live/TwitchAppTokenProviderTests.cs |
Tests Twitch token caching. |
tests/StaticHost.Tests/Live/RedisIntegrationFixture.cs |
Provides Redis integration infrastructure. |
tests/StaticHost.Tests/Live/LiveTestHelpers.cs |
Adds live-status test helpers. |
tests/StaticHost.Tests/Live/LiveStreamTests.cs |
Tests SSE streaming. |
tests/StaticHost.Tests/Live/LiveStatusJsonTests.cs |
Tests JSON naming. |
tests/StaticHost.Tests/Live/LiveStatusCoordinationTests.cs |
Tests coordination behavior. |
tests/StaticHost.Tests/Live/InMemoryLiveStatusInfrastructure.cs |
Adds in-memory test implementations. |
tests/StaticHost.Tests/GlobalUsings.cs |
Adds live-status test imports. |
tests/Aspire.Dev.AppHost.Tests/LiveDevCommandsTests.cs |
Tests AppHost live commands. |
tests/Aspire.Dev.AppHost.Tests/LiveConfigurationTests.cs |
Tests production configuration. |
tests/Aspire.Dev.AppHost.Tests/GlobalUsings.cs |
Adds AppHost test imports. |
tests/Aspire.Dev.AppHost.Tests/Aspire.Dev.AppHost.Tests.csproj |
Adds the AppHost test project. |
src/statichost/StaticHost/wwwroot/scalar/aspire-theme.css |
Adds Scalar branding. |
src/statichost/StaticHost/wwwroot/.gitignore |
Ignores generated StaticHost assets. |
src/statichost/StaticHost/StaticHost.csproj |
Adds live/API packages and branding assets. |
src/statichost/StaticHost/Program.cs |
Registers live APIs and Scalar. |
src/statichost/StaticHost/Live/YouTube/YouTubeWebhookHandler.cs |
Handles YouTube signatures and payloads. |
src/statichost/StaticHost/Live/YouTube/YouTubeLiveConfirmationQueue.cs |
Coalesces confirmation polls. |
src/statichost/StaticHost/Live/YouTube/YouTubeClient.cs |
Implements YouTube API calls. |
src/statichost/StaticHost/Live/YouTube/RedisYouTubeWebSubSubscriptionState.cs |
Persists WebSub state in Redis. |
src/statichost/StaticHost/Live/YouTube/IYouTubeClient.cs |
Defines the YouTube client contract. |
src/statichost/StaticHost/Live/Twitch/TwitchWebhookHandler.cs |
Handles Twitch EventSub callbacks. |
src/statichost/StaticHost/Live/Twitch/TwitchEventSubService.cs |
Reconciles Twitch subscriptions. |
src/statichost/StaticHost/Live/Twitch/TwitchClient.cs |
Implements Twitch API calls. |
src/statichost/StaticHost/Live/Twitch/TwitchAppTokenProvider.cs |
Manages Twitch app tokens. |
src/statichost/StaticHost/Live/Twitch/ITwitchClient.cs |
Defines the Twitch client contract. |
src/statichost/StaticHost/Live/LiveStatusSynchronizer.cs |
Synchronizes Redis state locally. |
src/statichost/StaticHost/Live/LiveStatusServiceCollectionExtensions.cs |
Registers live-status services. |
src/statichost/StaticHost/Live/LiveStatusRedis.cs |
Adds Redis primitives and concurrency handling. |
src/statichost/StaticHost/Live/LiveStatusOptions.cs |
Defines live-status configuration. |
src/statichost/StaticHost/Live/LiveStatus.cs |
Defines live-status models and JSON metadata. |
src/statichost/StaticHost/GlobalUsings.cs |
Adds live namespace imports. |
src/statichost/StaticHost/appsettings.json |
Adds live-status defaults. |
src/frontend/tests/unit/twoslash-hover-runtime.vitest.test.ts |
Tests Twoslash runtime behavior. |
src/frontend/tests/unit/stream-embeds.vitest.test.ts |
Tests embed URL generation. |
src/frontend/tests/unit/live-status.vitest.test.ts |
Tests live-status client behavior. |
src/frontend/tests/unit/custom-components.vitest.test.ts |
Extends embed rendering tests. |
src/frontend/tests/typecheck/component-props.contracts.ts |
Extends component prop contracts. |
src/frontend/tests/e2e/ui-regressions.spec.ts |
Adds live and navigation regressions. |
src/frontend/tests/e2e/twoslash-navigation.spec.ts |
Tests Twoslash navigation. |
src/frontend/tests/e2e/mermaid-navigation.spec.ts |
Tests Mermaid navigation. |
src/frontend/tests/e2e/filter-navigation.spec.ts |
Tests filter state across navigation. |
src/frontend/src/styles/site.css |
Uses shared brand tokens. |
src/frontend/src/styles/mermaid.css |
Adds Mermaid styling. |
src/frontend/src/styles/aspire-brand.css |
Defines shared brand tokens. |
src/frontend/src/scripts/twoslash-hover.ts |
Manages Twoslash popup lifecycle. |
src/frontend/src/pages/reference/api/typescript/index.astro |
Adds scoped TypeScript API search. |
src/frontend/src/pages/reference/api/typescript/[module]/index.astro |
Adds module search lifecycle. |
src/frontend/src/pages/reference/api/typescript/[module]/[item]/index.astro |
Adds item search lifecycle. |
src/frontend/src/pages/reference/api/csharp/index.astro |
Adds scoped C# API search. |
src/frontend/src/pages/reference/api/csharp/[package]/index.astro |
Adds package search lifecycle. |
src/frontend/src/pages/reference/api/csharp/[package]/[type]/index.astro |
Adds type search lifecycle. |
src/frontend/src/data/aspire-integrations.json |
Adds the Floci integration. |
src/frontend/src/content/docs/whats-new/aspire-9-4.mdx |
Updates deployment pipeline guidance. |
src/frontend/src/content/docs/ja/deployment/pipelines.mdx |
Updates Japanese pipeline documentation. |
src/frontend/src/content/docs/diagnostics/aspirepipelines003.mdx |
Updates container API diagnostics. |
src/frontend/src/content/docs/diagnostics/aspirepipelines002.mdx |
Updates deployment-state diagnostics. |
src/frontend/src/content/docs/diagnostics/aspirepipelines001.mdx |
Updates pipeline diagnostics. |
src/frontend/src/content/docs/deployment/pipelines.mdx |
Updates pipeline API documentation. |
src/frontend/src/content/docs/dashboard/overview.mdx |
Refreshes dashboard capabilities. |
src/frontend/src/content/docs/community/videos.mdx |
Replaces videos with live streams. |
src/frontend/src/content/docs/community/index.mdx |
Updates the community CTA. |
src/frontend/src/components/YouTubeEmbed.astro |
Adds playlist and channel embeds. |
src/frontend/src/components/YouTubeCard.astro |
Makes card behavior navigation-safe. |
src/frontend/src/components/TwitchEmbed.astro |
Adds deferred Twitch embeds. |
src/frontend/src/components/ThreeTierAspire.astro |
Reinitializes after navigation. |
src/frontend/src/components/stream-embeds.ts |
Centralizes embed utilities. |
src/frontend/src/components/starlight/Header.astro |
Adds the live-stream header control. |
src/frontend/src/components/SampleGrid.astro |
Adds navigation cleanup. |
src/frontend/src/components/PivotSelector.astro |
Adds navigation-aware initialization. |
src/frontend/src/components/LoopingVideo.astro |
Adds lifecycle-safe video initialization. |
src/frontend/src/components/LoopingImage.astro |
Adds lifecycle-safe image initialization. |
src/frontend/src/components/IntegrationTotals.astro |
Updates navigation-triggered totals. |
src/frontend/src/components/Integrations.astro |
Adds lifecycle-safe filtering. |
src/frontend/src/components/DashboardCarousel.astro |
Reinitializes the carousel after navigation. |
src/frontend/src/components/AsciinemaPlayer.astro |
Updates player lifecycle handling. |
src/frontend/src/components/api-reference/VersionFilter.astro |
Adds controller disposal. |
src/frontend/src/components/api-reference/search-lifecycle.ts |
Adds API search lifecycle management. |
src/frontend/src/components/api-reference/inpage-search-sync.ts |
Scopes and aborts search handlers. |
src/frontend/src/assets/icons/live.svg |
Adds the live-stream icon. |
src/frontend/scripts/build-static-host.mjs |
Builds frontend assets for StaticHost. |
src/frontend/pnpm-workspace.yaml |
Updates dependency overrides and patches. |
src/frontend/patches/@astrojs__starlight@0.41.3.patch |
Patches Starlight search lifecycle handling. |
src/frontend/package.json |
Updates frontend scripts and dependencies. |
src/frontend/ec.config.mjs |
Configures Twoslash runtime modules. |
src/frontend/config/sidebar/community.topics.ts |
Renames a community navigation topic. |
src/frontend/astro.config.mjs |
Adds StaticHost proxy configuration. |
src/apphost/Aspire.Dev.AppHost/Aspire.Dev.AppHost.csproj |
Adds Azure resources and test visibility. |
src/apphost/Aspire.Dev.AppHost/AppHost.cs |
Adds Redis and live-status wiring. |
Aspire.Dev.slnx |
Includes the AppHost test project. |
.gitignore |
Ignores Aspire output. |
.github/workflows/ci.yml |
Updates CI change detection. |
.github/workflows/apphost-build.yml |
Builds and tests AppHost and StaticHost. |
Review details
Suppressed comments (5)
src/frontend/src/content/docs/whats-new/aspire-9-4.mdx:162
- This revised “current” pipeline example still constructs
InteractionInputwithout its requiredNameproperty. The 13.5 interaction API requires a name for prompt inputs, so a reader copying this sample will get an invalid input definition; add a stable name such asenvironmentto the initializer.
src/frontend/tests/e2e/ui-regressions.spec.ts:304 - Adding
liveLinkshiftsmenuButtonfrom index 3 to index 4, butmenuButtonBoxstill readscontrolBoxes[3]. The following centering assertion therefore compares the menu icon againsttryLinkinstead of the menu button and can fail or miss a real alignment regression; use the menu button's new index (or avoid positional indexing).
src/statichost/StaticHost/Live/LiveEndpoints.cs:420 - This confirmation path always calls
GetCurrentLiveAsync, which uses YouTubesearch.list, even when the canonical snapshot already has a live video ID. That bypasses the low-costvideos.listpath used byYouTubeWebSubService.TickAsyncand can spend the discovery quota on every duplicate/title-change WebSub notification; useGetVideoLiveStatusAsyncfor an existing live video and reserveGetCurrentLiveAsyncfor offline/no-ID discovery.
src/statichost/StaticHost/Live/LiveStatusOptions.cs:15 - These remarks overstate the fallback behavior: the workers only stay idle when their API credentials are missing; a missing
WebhookSecretstill allows polling/seeding, and the SSE endpoint serves the existing canonical Redis snapshot rather than unconditionally reportingisLive: false. Please describe the API-credential and webhook-secret cases separately and avoid promising an offline snapshot.
src/statichost/StaticHost/Live/LiveStatusServiceCollectionExtensions.cs:25 - The registration extension repeats the inaccurate claim that any missing secret leaves the corresponding worker idle and the SSE output false. In this implementation, API credentials control whether a provider worker starts; a missing webhook secret only skips subscription/verification while polling can continue, and Redis may still contain a live snapshot.
- Files reviewed: 129/141 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Refresh integrity metadata from the public npm registry while preserving all pinned dependency versions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Keep the Floci entry with 100 downloads and remove the earlier duplicate that caused resource catalog prerendering to fail. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
David Pine (IEvangelist)
enabled auto-merge (squash)
September 16, 2026 15:02
Contributor
Frontend HTML artifact readyThe latest frontend build uploaded the This comment updates automatically when a new frontend build artifact is uploaded. |
Remove obsolete MDX export and embed assertions while retaining coverage of all original community videos in the resource catalog. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
David Pine (IEvangelist)
approved these changes
Sep 16, 2026
Restore glossary filters after Astro page transitions and preserve pagination focus during query-only history traversal. Update Twitch and header assertions for the merged live page and header action. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Wait for lazy artwork icons to decode and normalize rounded corners during texture-only screenshots. Keep exact image equality and existing statistical thresholds, attaching mismatched captures instead of dumping binary buffers. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This was referenced Sep 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.