ci(docs): lock mint CLI via docs manifest

[weselben]

Fixes #110

TL;DR

Docs Validation resolves mint (and its whole dependency tree) from live npm metadata on every run, so a broken upstream publish fails unrelated merges — seen on upstream main where a merged commit failed with ETARGET @mintlify/common@1.0.1165 while all 13 other checks passed. This PR makes the job resolve nothing at run time: manifest + committed lockfile + npm ci.

Files (5, +14.7k / -1 — all but ~20 lines are the generated lockfile):

File	Why
docs/package-lock.json	Full pinned tree incl. integrity hashes — npm ci does zero run-time resolution.
docs/package.json (small, read this one)	mint@4.2.923 pinned as devDependency + scripts (dev, build, validate, broken-links).
.github/workflows/test.yml	Step becomes npm ci && npm run validate; setup-node gains cache: npm; PUPPETEER_SKIP_DOWNLOAD=1 (chrome only needed by mint dev/broken-links).
.github/dependabot.yml	npm ecosystem entry for /docs — bump PRs update manifest + lockfile together, weekly, grouped like the existing ecosystems.
.gitignore	/docs/node_modules/ next to the dashboard entry.

Dependabot wiring

Included directly in this PR, not a follow-up: the new npm /docs ecosystem picks up docs/package-lock.json and owns future mint bumps the same way gomod/docker/github-actions are handled today. Note Dependabot cannot see versions inside workflow run: steps, which is why the manifest route is used instead of pinning inside npx mint@x.y.z.

Verification

Full CI flow executed locally against this tree (node 26 / npm 11, lockfile format v3):

$ cd docs && npm ci --no-fund --no-audit
$ npm run validate
success build validation passed

mint validate passes on the current docs content; the only pre-existing local failure mode was a flaky puppeteer chrome download, now skipped in CI via PUPPETEER_SKIP_DOWNLOAD=1 (validate is static).

Moved upstream: ENTERPILOT#1081, tracking upstream issue ENTERPILOT#1080.

Written by AI

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 712fb98d-ca4a-4643-9963-0fa35ae5f586

📥 Commits

Reviewing files that changed from the base of the PR and between ea0701a and d40a8fb.

📒 Files selected for processing (3)

• .github/dependabot.yml
• .gitignore
• docs/package.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9bcd3a5e-11ff-4def-9934-1b8c51ee8d07

📥 Commits

Reviewing files that changed from the base of the PR and between d6f8924 and ea0701a.

⛔ Files ignored due to path filters (1)

• docs/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (4)

• .github/dependabot.yml
• .github/workflows/test.yml
• .gitignore
• docs/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The docs package pins the Mintlify CLI and defines its scripts. Docs validation now installs dependencies from the lockfile and runs the package validation script. Dependabot checks npm dependencies in /docs weekly.

Changes

Docs validation

Layer / File(s)	Summary
Define and run locked docs validation .github/dependabot.yml, .github/workflows/test.yml, .gitignore, docs/package.json	The package pins mint and defines Mintlify CLI scripts. The workflow uses npm ci and npm run validate. Dependabot checks npm dependencies in /docs, and .gitignore excludes /docs/node_modules/.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: santiagodepolonia

Merge Risk: ⚪ Minimal · up to ea070

Docs validation uses the locked dependencies from the intended directory and is ready to merge after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	PR #111 addresses the coding requirements in issue #110. It adds docs/package.json with mint@4.2.923, uses npm ci --no-fund --no-audit followed by npm run validate, enables npm caching with `d…
Out of Scope Changes check	✅ Passed	The reviewed changes stay within issue #110. The manifest, lockfile, workflow changes, npm cache configuration, Puppeteer setting, Dependabot entry, and docs/node_modules/ ignore rule directly suppo…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Title check	✅ Passed	The title clearly summarizes the main change: locking the Mint CLI dependency for documentation CI.
Description check	✅ Passed	The description clearly explains the problem, implementation, affected files, Dependabot configuration, and local verification. It does not use the template's ## Description heading, but it provides…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge and correctly replaces live CLI resolution with a coherent manifest-and-lockfile installation flow.

Summary

This PR makes documentation validation reproducible by installing an exact Mint CLI dependency tree from a committed npm manifest and lockfile.

• Replaces live npx mint validate resolution with npm ci followed by the manifest’s validation script.
• Enables setup-node’s npm cache and skips the unnecessary Puppeteer browser download.
• Adds weekly grouped Dependabot updates for the documentation package.
• Ignores the resulting documentation node_modules directory.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Change under docs/] --> B[Setup Node 22]
  B --> C[Restore npm cache]
  C --> D[npm ci from committed lockfile]
  D --> E[npm run validate]
  F[Weekly Dependabot run] --> G[Update docs manifest and lockfile]
  G --> A

Loading

_{Reviews (1) · Last reviewed commit: "ci(docs): lock mint CLI via docs manifes..."}