Modernize build dependencies and standardize version management

.claude/commands/docs-review.md

@@ -137,6 +137,9 @@ Always provide relevant line numbers for any issues you identify.
 - **Files moved, renamed, or deleted**:
   - Confirm that moved or renamed files have appropriate aliases added to the frontmatter to avoid broken links.
   - Confirm that deleted files have a redirect created, if applicable.
+- **Build, test, and infrastructure changes**:
+  - If changes are made to build scripts (scripts/), GitHub Actions workflows (.github/workflows/), the Makefile, or infrastructure code (infrastructure/), verify that BUILD-AND-DEPLOY.md has been updated to reflect these changes.
+  - Examples of changes requiring documentation updates: new make targets, modified deployment workflows, infrastructure configuration changes, new environment variables, updated build processes.
 - **Images and assets**:
   - Check images have alt text for accessibility.
   - Verify image file sizes are reasonable.

.devcontainer/devcontainer.json

@@ -9,10 +9,10 @@
 			"version": "lts"
 		},
 		"ghcr.io/devcontainers/features/go:1": {
-			"version": "latest"
+			"version": "1.25"
 		},
 		"ghcr.io/devcontainers/features/hugo:1": {
-			"version": "latest"
+			"version": "0.151.0"
 		},
 		"ghcr.io/devcontainers/features/python:1": {
 			"installTools": true,

.editorconfig

@@ -0,0 +1,14 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{js,ts,jsx,tsx,json,yaml,yml}]
+indent_style = space
+indent_size = 4
+
+[*.{yaml,yml}]
+indent_size = 2

.github/dependabot.yml

@@ -0,0 +1,96 @@
+version: 2
+updates:
+  # Root package.json
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 10
+    groups:
+      aws-sdk:
+        patterns: ["@aws-sdk/*"]
+      pulumi:
+        patterns: ["@pulumi/*"]
+      testing:
+        patterns: ["cypress", "jest*", "@types/jest"]
+      development:
+        patterns: ["prettier", "husky", "markdownlint"]
+    ignore:
+      - dependency-name: "tailwindcss"
+      # Stay on Prettier v2.x due to v3.x performance regression (6x slower)
+      # See BUILD-AND-DEPLOY.md for details
+      - dependency-name: "prettier"
+        update-types: ["version-update:semver-major"]
+    labels: ["dependencies", "npm"]
+    commit-message:
+      prefix: "deps"
+      include: "scope"
+
+  # Theme package.json
+  - package-ecosystem: "npm"
+    directory: "/theme"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 10
+    groups:
+      webpack:
+        patterns: ["webpack*", "*-loader", "*-webpack-plugin*"]
+      algolia:
+        patterns: ["@algolia/*", "algoliasearch"]
+    ignore:
+      - dependency-name: "tailwindcss"
+    labels: ["dependencies", "npm", "theme"]
+    commit-message:
+      prefix: "deps(theme)"
+      include: "scope"
+
+  # Stencil package.json
+  - package-ecosystem: "npm"
+    directory: "/theme/stencil"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    groups:
+      stencil:
+        patterns: ["@stencil/*"]
+      testing:
+        patterns: ["jest*", "puppeteer"]
+    labels: ["dependencies", "npm", "stencil"]
+    commit-message:
+      prefix: "deps(stencil)"
+      include: "scope"
+
+  # Infrastructure package.json
+  - package-ecosystem: "npm"
+    directory: "/infrastructure"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    groups:
+      pulumi:
+        patterns: ["@pulumi/*"]
+    labels: ["dependencies", "npm", "infrastructure"]
+    commit-message:
+      prefix: "deps(infra)"
+      include: "scope"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    labels: ["dependencies", "github-actions"]
+    commit-message:
+      prefix: "ci"
+      include: "scope"

.github/workflows/bucket-cleanup-testing.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Fetch secrets from ESC
         id: esc-secrets
         uses: pulumi/esc-action@v1
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
         with:

.github/workflows/bucket-cleanup.yml

@@ -18,15 +18,15 @@ jobs:
       - name: Fetch secrets from ESC
         id: esc-secrets
         uses: pulumi/esc-action@v1
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
         with:
           node-version: '22.x'
 
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v5
         with:
-          go-version: 1.20.x
+          go-version: 1.25.x
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2

.github/workflows/build-and-deploy.yml

@@ -25,19 +25,19 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
         with:
           node-version: '22.x'
 
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v5
         with:
-          go-version: 1.20.x
+          go-version: 1.25.x
 
       - uses: peaceiris/actions-hugo@v2
         with:
-          hugo-version: '0.135.0'
+          hugo-version: '0.151.0'
           extended: true
 
       - name: Configure AWS Credentials

.github/workflows/check-links.yml

@@ -16,15 +16,15 @@ jobs:
       - name: Fetch secrets from ESC
         id: esc-secrets
         uses: pulumi/esc-action@v1
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Install Node
         uses: actions/setup-node@v4
         with:
           node-version: '22.x'
       - name: Install Hugo
         uses: peaceiris/actions-hugo@v2
         with:
-          hugo-version: '0.135.0'
+          hugo-version: '0.151.0'
           extended: true
       - name: Run make check_links
         run: make check_links

.github/workflows/check-search-urls.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Fetch secrets from ESC
         id: esc-secrets
         uses: pulumi/esc-action@v1
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - name: Install Node
         uses: actions/setup-node@v4
@@ -25,7 +25,7 @@ jobs:
 
       - uses: peaceiris/actions-hugo@v2
         with:
-          hugo-version: '0.135.0'
+          hugo-version: '0.151.0'
           extended: true
 
       - uses: algolia/setup-algolia-cli@master

.github/workflows/esc-cli.yml

@@ -20,7 +20,7 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
       - name: checkout docs repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: set the esc version
         run: |
           echo "ESC_VERSION=${{ github.event.client_payload.ref }}" >> $GITHUB_ENV
@@ -43,11 +43,11 @@ jobs:
         run: |
           echo "ESC_VERSION=${{ github.event.client_payload.ref }}" >> $GITHUB_ENV
       - name: checkout docs repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           path: docs
       - name: checkout esc repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           repository: pulumi/esc
           path: esc
@@ -64,10 +64,10 @@ jobs:
       - name: Install Hugo
         uses: peaceiris/actions-hugo@v2
         with:
-          hugo-version: '0.135.0'
+          hugo-version: '0.151.0'
           extended: true
       - name: Install node
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v4
         with:
           node-version: ${{matrix.nodeversion}}
       - run: make ensure
@@ -97,7 +97,7 @@ jobs:
     strategy:
       matrix:
         nodeversion:
-          - "20.x"
+          - "22.x"
   notify:
     if: failure()
     name: Send slack notification

.github/workflows/pr-closed.yml

@@ -19,15 +19,15 @@ jobs:
       - name: Fetch secrets from ESC
         id: esc-secrets
         uses: pulumi/esc-action@v1
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
         with:
           node-version: '22.x'
 
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v5
         with:
-          go-version: 1.20.x
+          go-version: 1.25.x
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2

.github/workflows/pull-request.yml

@@ -21,15 +21,15 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
         with:
           node-version: '22.x'
 
       - uses: peaceiris/actions-hugo@v2
         with:
-          hugo-version: '0.135.0'
+          hugo-version: '0.151.0'
           extended: true
 
       - name: Configure AWS Credentials

.github/workflows/pulumi-cli.yml

@@ -21,7 +21,7 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
       - name: checkout docs repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: set the pulumi version
         run: |
           echo "PULUMI_VERSION=${{ github.event.client_payload.ref }}" >> $GITHUB_ENV
@@ -44,11 +44,11 @@ jobs:
         run: |
           echo "PULUMI_VERSION=${{ github.event.client_payload.ref }}" >> $GITHUB_ENV
       - name: checkout docs repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           path: docs
       - name: checkout pulumi repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           repository: pulumi/pulumi
           path: pulumi
@@ -62,26 +62,26 @@ jobs:
         with:
           pulumi-version: ${{ env.PULUMI_VERSION }}
       - name: Install go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ matrix.goversion }}
       - name: Install Hugo
         uses: peaceiris/actions-hugo@v2
         with:
-          hugo-version: '0.135.0'
+          hugo-version: '0.151.0'
           extended: true
       - name: Install node
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v4
         with:
           node-version: ${{matrix.nodeversion}}
       - name: Install python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: ${{matrix.pythonversion}}
       - name: Install Pipenv
         run: pip3 install pipenv
       - name: Install dotnet
-        uses: actions/setup-dotnet@v1
+        uses: actions/setup-dotnet@v4
         with:
           dotnet-version: ${{matrix.dotnetverson}}
       - run: make ensure
@@ -133,11 +133,11 @@ jobs:
         dotnetversion:
           - 3.1.301
         goversion:
-          - 1.16.x
+          - 1.25.x
         pythonversion:
           - "3.13"
         nodeversion:
-          - "20.x"
+          - "22.x"
   notify:
     if: failure()
     name: Send slack notification