docs: sync docs/v0.2 to v0.2.3 + SEO improvements

.cargo/audit.toml

@@ -1,8 +1,6 @@
 [advisories]
 ignore = [
   "RUSTSEC-2025-0140", # gix-date UTF-8 contract issue dependency of cargo-generate
-  "RUSTSEC-2026-0001", # rkyv undefined behavior on OOM dependency of byte-unit
-  "RUSTSEC-2026-0037", # quinn-proto DoS - transitive via reqwest/ic-agent, quinn feature not used
 
   # Unmaintained crates (transitive dependencies)
   "RUSTSEC-2021-0127", # serde_cbor - dependency of ic-agent/ic-transport-types

.claude/skills/release/task6-docs.md

@@ -2,7 +2,9 @@
 
 *Skip if `$ARGUMENTS` is a beta release. Requires Task 2. Runs concurrently with Task 3.*
 
-The tag push triggers a docs deployment workflow that builds and publishes the versioned docs to `/icp-cli/X.Y/`. The `versions.json` PR must not be merged until that deployment succeeds, otherwise the root redirect will point to a path that does not exist yet.
+The tag push triggers a docs deployment workflow that builds and publishes the versioned docs to `/X.Y/` on the `docs-deployment` branch (served at `https://cli.internetcomputer.org/X.Y/`). The `versions.json` PR must not be merged until that deployment succeeds, otherwise the root redirect will point to a path that does not exist yet.
+
+Once the `versions.json` PR merges to `main`, the `publish-root-files` CI job runs automatically and copies `og-image.png`, `llms.txt`, `llms-full.txt`, and `feed.xml` from the new version's folder to the deployment root — no manual step needed.
 
 **1. Wait for the docs deployment triggered by the tag**
 ```bash

.github/CONTRIBUTING.md

@@ -80,7 +80,7 @@ If you want to submit a pull request to fix an issue or add a feature, here's a
 
 ## Contributing to Documentation
 
-The documentation lives in the `docs/` directory and is deployed to https://dfinity.github.io/icp-cli/.
+The documentation lives in the `docs/` directory and is deployed to https://cli.internetcomputer.org.
 
 ### Documentation Structure
 
@@ -97,7 +97,7 @@ The documentation site uses [Astro](https://astro.build/) with [Starlight](https
 1. **Source files** (`docs/`) are Markdown with minimal YAML frontmatter (title + description)
 2. **Starlight** reads directly from `docs/` via the glob content loader
 3. **Rehype plugin** (`docs-site/plugins/rehype-rewrite-links.mjs`) rewrites `.md` links at build time for Starlight's clean URLs
-4. **GitHub Actions** automatically deploys to GitHub Pages on push to main
+4. **GitHub Actions** automatically builds and deploys to an IC asset canister on push to main
 
 This architecture keeps source docs GitHub-friendly (`.md` links work on GitHub) while producing clean URLs on the documentation site.
 

.github/workflows/audit.yml

@@ -38,7 +38,7 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup image (Linux)
         run: ./.github/scripts/provision-linux-build.sh
-      - uses: actions-rust-lang/audit@410bbe6de17ca06c0a60070cca18c88b485ca5a1 # v1.2.6
+      - uses: actions-rust-lang/audit@72c09e02f132669d52284a3323acdb503cfc1a24 # v1.2.7

.github/workflows/checks.yml

@@ -14,12 +14,13 @@ jobs:
     permissions:
       pull-requests: read
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
-          # 'src' is true when any changed file matches a positive pattern
-          # and does not match a negative pattern (! prefix).
+          # With 'every', a changed file is matched only when it satisfies
+          # ALL rules: the positive pattern AND every negated pattern.
+          predicate-quantifier: 'every'
           filters: |
             src:
               - '**'
@@ -34,12 +35,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup image (Linux)
         run: ./.github/scripts/provision-linux-build.sh
 
-      - uses: actions-rust-lang/setup-rust-toolchain@a0b538fa0b742a6aa35d6e2c169b4bd06d225a98 # v1.15.3
+      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
         with:
           cache-shared-key: ${{ runner.os }}-checks
 
@@ -55,12 +56,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup image (Linux)
         run: ./.github/scripts/provision-linux-build.sh
 
-      - uses: actions-rust-lang/setup-rust-toolchain@a0b538fa0b742a6aa35d6e2c169b4bd06d225a98 # v1.15.3
+      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
         with:
           cache-shared-key: ${{ runner.os }}-checks
 
@@ -76,12 +77,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup image (Linux)
         run: ./.github/scripts/provision-linux-build.sh
 
-      - uses: actions-rust-lang/setup-rust-toolchain@a0b538fa0b742a6aa35d6e2c169b4bd06d225a98 # v1.15.3
+      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
         with:
           cache-shared-key: ${{ runner.os }}-checks
 
@@ -95,7 +96,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install taplo
         run: |
@@ -123,12 +124,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup image (Linux)
         run: ./.github/scripts/provision-linux-build.sh
 
-      - uses: actions-rust-lang/setup-rust-toolchain@a0b538fa0b742a6aa35d6e2c169b4bd06d225a98 # v1.15.3
+      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
         with:
           cache-shared-key: ${{ runner.os }}-checks
 
@@ -158,12 +159,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup image (Linux)
         run: ./.github/scripts/provision-linux-build.sh
 
-      - uses: actions-rust-lang/setup-rust-toolchain@a0b538fa0b742a6aa35d6e2c169b4bd06d225a98 # v1.15.3
+      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
         with:
           cache-shared-key: ${{ runner.os }}-checks
 

.github/workflows/deny.yml

@@ -29,10 +29,10 @@ jobs:
     name: license-check:required
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup image (Linux)
         run: ./.github/scripts/provision-linux-build.sh
       - run: rm rust-toolchain.toml
-      - uses: EmbarkStudios/cargo-deny-action@f2ba7abc2abebaf185c833c3961145a3c275caad # v2.0.13
+      - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
         with:
           command: check bans licenses sources # skip advisories, which are handled by audit.yml

.github/workflows/docs-deploy.yml

@@ -16,7 +16,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout docs-deployment branch
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: docs-deployment
 

.github/workflows/docs.yml

@@ -4,9 +4,11 @@ on:
   push:
     tags:
       - 'v*'
+      - '!v*-*'    # exclude pre-release tags (e.g. v0.2.0-beta.0)
     branches:
       - main
       - 'docs/v*'
+      - '!docs/v*-*'  # exclude pre-release doc branches
     paths:
       - 'docs/**'
       - 'docs-site/**'
@@ -36,10 +38,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
 
       - name: Setup Node
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v4.2.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: '22'
           cache: 'npm'
@@ -58,15 +62,15 @@ jobs:
 
   # Publish root index, versions list, and IC config files - only runs on main branch
   publish-root-files:
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: build
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v4.2.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: '22'
 
@@ -113,19 +117,75 @@ jobs:
 
           echo "LATEST_VERSION=${LATEST_VERSION}" >> $GITHUB_ENV
 
-      - name: Copy llms.txt from latest version on docs-deployment branch
+          # Generate robots.txt — allow only the latest version, block old versions.
+          # /main/ is disallowed unless it IS the latest version (no releases yet fallback).
+          {
+            echo "User-agent: *"
+            echo "Allow: /${LATEST_VERSION}/"
+            for version in $(jq -r '.versions[].version' docs-site/versions.json); do
+              if [[ "$version" != "$LATEST_VERSION" ]]; then
+                echo "Disallow: /${version}/"
+              fi
+            done
+            if [[ "$LATEST_VERSION" != "main" ]]; then echo "Disallow: /main/"; fi
+            echo ""
+            echo "Sitemap: ${PUBLIC_SITE}/sitemap.xml"
+            echo ""
+            echo "# LLM and AI agent discovery (llmstxt.org)"
+            echo "# ${PUBLIC_SITE}/llms.txt"
+            echo "# ${PUBLIC_SITE}/llms-full.txt"
+          } > root/robots.txt
+          echo "✅ Generated robots.txt (latest: ${LATEST_VERSION})"
+
+          # Generate root sitemap.xml pointing directly to the latest version's sitemap.
+          # Points to sitemap-0.xml (not sitemap-index.xml) to stay spec-compliant:
+          # a sitemapindex must reference sitemaps, not other sitemapindex files.
+          {
+            echo '<?xml version="1.0" encoding="UTF-8"?>'
+            echo '<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">'
+            echo '  <sitemap>'
+            echo "    <loc>${PUBLIC_SITE}/${LATEST_VERSION}/sitemap-0.xml</loc>"
+            echo '  </sitemap>'
+            echo '</sitemapindex>'
+          } > root/sitemap.xml
+          echo "✅ Generated sitemap.xml → /${LATEST_VERSION}/sitemap-0.xml"
+
+      - name: Copy files from latest version on docs-deployment branch
         run: |
-          # Fetch the llms.txt from the latest version's folder on docs-deployment.
-          # This file was deployed by publish-versioned-docs and is always in sync
-          # with the versioned .md endpoints it links to.
           git fetch origin docs-deployment --depth=1
+
+          # llms.txt — agent discovery index (versioned copy is always in sync with .md endpoints)
           if git show "origin/docs-deployment:${LATEST_VERSION}/llms.txt" > root/llms.txt 2>/dev/null; then
             echo "✅ Copied llms.txt from /${LATEST_VERSION}/llms.txt to root"
           else
             echo "⚠️  No llms.txt found at /${LATEST_VERSION}/llms.txt on docs-deployment — skipping"
             rm -f root/llms.txt
           fi
 
+          # llms-full.txt — full content dump for bulk ingestion / RAG pipelines
+          if git show "origin/docs-deployment:${LATEST_VERSION}/llms-full.txt" > root/llms-full.txt 2>/dev/null; then
+            echo "✅ Copied llms-full.txt from /${LATEST_VERSION}/llms-full.txt to root"
+          else
+            echo "⚠️  No llms-full.txt found at /${LATEST_VERSION}/llms-full.txt on docs-deployment — skipping"
+            rm -f root/llms-full.txt
+          fi
+
+          # og-image.png — social sharing preview image
+          if git show "origin/docs-deployment:${LATEST_VERSION}/og-image.png" > root/og-image.png 2>/dev/null; then
+            echo "✅ Copied og-image.png from /${LATEST_VERSION}/og-image.png to root"
+          else
+            echo "⚠️  No og-image.png found at /${LATEST_VERSION}/og-image.png on docs-deployment — skipping"
+            rm -f root/og-image.png
+          fi
+
+          # feed.xml — RSS feed
+          if git show "origin/docs-deployment:${LATEST_VERSION}/feed.xml" > root/feed.xml 2>/dev/null; then
+            echo "✅ Copied feed.xml from /${LATEST_VERSION}/feed.xml to root"
+          else
+            echo "⚠️  No feed.xml found at /${LATEST_VERSION}/feed.xml on docs-deployment — skipping"
+            rm -f root/feed.xml
+          fi
+
       - name: Prepend version navigation to root llms.txt
         if: hashFiles('root/llms.txt') != ''
         run: |
@@ -156,15 +216,17 @@ jobs:
 
   # Publish main branch docs for preview (always available at /main/)
   publish-main-docs:
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: build
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
 
       - name: Setup Node
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v4.2.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: '22'
           cache: 'npm'
@@ -200,10 +262,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
 
       - name: Setup Node
-        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v4.2.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: '22'
           cache: 'npm'

.github/workflows/release-npm.yml

@@ -25,12 +25,12 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.version }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'