Implemented version switcher for docs the Operators way

[nastena1606]

No description provided.

[Copilot]

Pull request overview

This PR introduces “Operators-style” docs versioning by enabling the MkDocs Material version switcher (via mike) and adding GitHub Actions workflows to deploy and lint documentation, plus updating Open Graph links to point at the latest docs path.

Changes:

• Enable MkDocs Material version provider (mike) in the shared MkDocs base config.
• Add a deployment workflow that deploys versioned docs via mike to the publish branch.
• Add a Vale workflow for docs linting on pull requests; update OG meta URLs for the versioned docs path.

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
mkdocs-base.yml	Enables Material’s version switcher configuration using mike as the provider.
.nojekyll	Ensures static hosting doesn’t process the output with Jekyll.
.github/workflows/vale.yml	Adds PR-time Vale linting (currently has YAML/indentation issues to fix).
.github/workflows/main.yaml	Adds push-to-main deployment workflow using mike deploy / mike set-default.
_resourcepdf/overrides/main.html	Updates OG image/URL meta tags to use the latest docs path.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[radoslawszulgo]

GIT_USER is set but never read anywhere in this repo (checked both main.yaml and vale.yml — no consumer). So lines 34–35 aren't just risky, they're dead code that adds risk for no benefit.

Line 34 — git config user.password "${ROBOT_TOKEN}"
user.password isn't a real git config key (git doesn't read credentials from user.*). It does nothing functionally, but it does write the raw token in plaintext into ~/.gitconfig for the rest of the job. Pure downside, no upside — delete it.

Line 35 — echo "GIT_USER=percona-platform-robot:${ROBOT_TOKEN}" >> $GITHUB_ENV
This writes the token into $GITHUB_ENV, which means every subsequent step in the job gets GIT_USER (containing the raw secret) injected into its environment automatically — a much bigger blast radius than the one step that needs it. GitHub does mask the literal token value in logs, but that doesn't protect against a compromised/malicious dependency in a later step (e.g. something pulled in by pip install -r requirements.txt) reading $GIT_USER from its own env and exfiltrating it. Since nothing downstream even uses GIT_USER, this line should just go.

[radoslawszulgo]

Suggested change

	# Configure git auth right before it's needed, scoped to this checkout only,
	# so the credential isn't live on disk for the earlier setup steps.
	- name: Configure git
	env:
	ROBOT_TOKEN: ${{ secrets.ROBOT_TOKEN }}
	run: |
	git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic $(printf '%s' "x-access-token:${ROBOT_TOKEN}" | base64 -w0)"
	git config user.name "GitHub Action"
	git config user.email "github-action@users.noreply.github.com"

[radoslawszulgo]

• insteadOf → http.extraheader: instead of embedding percona-platform-robot:${ROBOT_TOKEN} directly in a rewritten URL (visible in git remote -v, cache dirs, etc.), the token is now sent as a base64-encoded HTTP Authorization: basic header via http.https://github.com/.extraheader.
• local instead of --global: scopes the credential to this one repo checkout (.git/config) instead of the whole runner's ~/.gitconfig, so it can't leak into unrelated git operations elsewhere in the job (e.g. anything pip install might do).
• Reduced lifetime: the "Configure git" step moved from the very start of the job to right before "Deploy docs" — the only step that actually needs write access. It's no longer configured during Python setup / release extraction / MkDocs install.

[radoslawszulgo]

Suggested change

	# Drop the credential as soon as it's no longer needed
	- name: Clear git credentials
	if: always()
	run: git config --local --unset-all http.https://github.com/.extraheader || true

[radoslawszulgo]

Explicit cleanup: added a final "Clear git credentials" step (if: always()) that unsets the extraheader as soon as the push is done.

[radoslawszulgo]

That action can be removed - I suggested a rewritten step later