feat: indexnow plugin as external pkg

Merged
WI
2d ago
+29-1120

Summary

Learn installs the published @netdata/netlify-plugin-indexnow package instead of a copy of the plugin checked in under plugins/netlify-plugin-indexnow/. A Dependabot update of @netlify/blobs or saxes is then an ordinary yarn.lock change. It no longer fails the Netlify build on the vendor contract.

 netlify.toml, static.toml
-  package = "./plugins/netlify-plugin-indexnow"
+  package = "@netdata/netlify-plugin-indexnow"
 build:netlify
   verify-git-history
-  verify-indexnow-vendor                         # pins checked in five places, SHA-256 of six files
   docusaurus build
   run-post-build-gates

 package.json
-  dependencies: "@netlify/blobs": "11.1.4", "saxes": "6.0.0"
+  devDependencies: "@netdata/netlify-plugin-indexnow": "^1.0.0"          # brings both as ^ ranges
 plugins/
-└── netlify-plugin-indexnow/      # 8 files incl. vendor-checksums.json
 scripts/
-└── verify-indexnow-vendor.js

The plugin's behavior, inputs (host, key, keyLocation) and receipt schema are unchanged.

  • Source and versioning: the package is published from netdata/website (plugins/netlify-plugin-indexnow/).
  • Tests: tests/indexnow_plugin.test.js runs the owner suite, with Learn's host and build directory, against the installed package. deploymentIntegrations.test.js checks that both TOML files name the package and that it is a dev dependency.
  • Docs: README.md "Dependency update authority" no longer claims owner-controlled packages are excluded from automatic updates, which dependabot.yml never did.

Evidence

  • Before: a Dependabot bump changes only the root pin and fails in the second step of build:netlify:

    IndexNow vendor verification failed: IndexNow dependency @netlify/blobs must be pinned to 11.1.4 in both package files
exit=1

    #3080 (@netlify/blobs 11.0.1 → 11.1.3) shows this in practice: it stayed open for a month and was closed as superseded by #3136.

    After: yarn.lock holds @netlify/blobs@^11.1.4 and saxes@^6.0.0 under the package; no file pins them exactly.

  • Tests: yarn test:run passes: Vitest 494 passed and 1 skipped, plus the first-touch (26), IndexNow (64), Swagger UI assets (3), dependency-authority (3) and site-build-gate (4) suites.

  • Package: 1.0.0 was released from netdata/website#1421 by its publish workflow. Apart from version and one README sentence, it is byte-identical to 1.0.0-test.0, which this PR was first tested against. yarn.lock changes only the package entry and the two re-keyed dependency entries.

Merge Danger

Door: two-way

Reverting this PR restores the vendored copy, its verify step and the root pins exactly.

Blast Radius: deploys

  • Every Netlify build loads the plugin. If the package couldn't be installed or loaded, every deploy would fail, including ingest. A plugin error at deploy time is only logged and never fails the deploy; submissions run only on production.
  • Left unchanged on purpose: config/seo-remediation-contract.json still names plugins/netlify-plugin-indexnow, because it's a frozen historical acceptance record.

Summary by CodeRabbit

  • Chores
    • Netlify builds now use the published IndexNow integration package instead of a repository-local copy.
    • The package is managed through the website’s standard dependency updates.
    • Updated integration checks to verify the published package configuration.