Skip to content

docs: add mermaid diagram rendering for Astro Starlight site#62

Merged
Mossaka merged 2 commits intomainfrom
copilot/fix-mermaid-diagram-rendering
Nov 26, 2025
Merged

docs: add mermaid diagram rendering for Astro Starlight site#62
Mossaka merged 2 commits intomainfrom
copilot/fix-mermaid-diagram-rendering

Conversation

Copy link
Contributor

Copilot AI commented Nov 26, 2025

Mermaid diagrams in the documentation were rendering as raw code blocks instead of visual diagrams.

Changes

  • Added dependencies: astro-mermaid@1.1.0 and mermaid@11.12.1
  • Configured integration: Added mermaid() before starlight() in astro.config.mjs (order matters)
  • Fixed invalid syntax: Removed style directives from sequenceDiagram in security-architecture.md (style only works in flowcharts)
// astro.config.mjs
import mermaid from 'astro-mermaid';

export default defineConfig({
  integrations: [
    mermaid(),  // Must come before starlight
    starlight({ ... }),
  ],
});

Result

All 8 mermaid diagrams now render properly:

Mermaid diagrams rendering

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com//advisories
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)
  • telemetry.astro.build
    • Triggering command: /usr/local/bin/node node /home/REDACTED/work/gh-aw-firewall/gh-aw-firewall/docs-site/node_modules/.bin/astro build (dns block)
    • Triggering command: /usr/local/bin/node node /home/REDACTED/work/gh-aw-firewall/gh-aw-firewall/docs-site/node_modules/.bin/astro preview --port 4321 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Original prompt

Render the mermaid diagram properly in astro documentaiton site. Currently it's not rendered

Custom agent used: technical-doc-writer
AI technical documentation writer for awf library using Astro Starlight


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix rendering of mermaid diagram in astro documentation docs: add mermaid diagram rendering for Astro Starlight site Nov 26, 2025
Copilot AI requested a review from Mossaka November 26, 2025 20:26
@Mossaka Mossaka marked this pull request as ready for review November 26, 2025 20:36
@Mossaka Mossaka merged commit 8e8e5f3 into main Nov 26, 2025
3 checks passed
@Mossaka Mossaka deleted the copilot/fix-mermaid-diagram-rendering branch November 26, 2025 20:36
Mossaka added a commit that referenced this pull request Feb 12, 2026
Sensitive tokens (GITHUB_TOKEN, ANTHROPIC_API_KEY, etc.) are written in
plaintext to docker-compose.yml inside the workDir (/tmp/awf-*). Since
the agent container mounts /tmp:/tmp:rw, any code inside the container
could read these secrets via `cat /tmp/awf-*/docker-compose.yml`.

Primary fix: Add tmpfs overlay on workDir (same pattern as mcp-logs
hiding) so the agent sees an empty in-memory filesystem instead of the
real directory containing docker-compose.yml with all tokens.

Secondary fix (defense-in-depth): Restrict file permissions on workDir
(0o700) and config files (0o600) so non-root processes on the host
cannot read them either.

Both normal mode and chroot mode are covered with appropriate paths.

Closes #62, closes #206, closes #210

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
lpcox pushed a commit that referenced this pull request Feb 12, 2026
)

* fix: hide workDir from agent container to prevent secrets exposure

Sensitive tokens (GITHUB_TOKEN, ANTHROPIC_API_KEY, etc.) are written in
plaintext to docker-compose.yml inside the workDir (/tmp/awf-*). Since
the agent container mounts /tmp:/tmp:rw, any code inside the container
could read these secrets via `cat /tmp/awf-*/docker-compose.yml`.

Primary fix: Add tmpfs overlay on workDir (same pattern as mcp-logs
hiding) so the agent sees an empty in-memory filesystem instead of the
real directory containing docker-compose.yml with all tokens.

Secondary fix (defense-in-depth): Restrict file permissions on workDir
(0o700) and config files (0o600) so non-root processes on the host
cannot read them either.

Both normal mode and chroot mode are covered with appropriate paths.

Closes #62, closes #206, closes #210

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: address review comments and fix Java workflow Maven proxy

- Improve tmpfs comment to clarify two separate security measures
  (mcp-logs hiding vs workDir hiding) and note that volume mounts
  to different container paths are unaffected by the tmpfs overlay
- Update types.ts tmpfs docstring per review feedback
- Fix build-test-java.md: use literal proxy values (squid-proxy:3128)
  instead of shell variables ${SQUID_PROXY_HOST}/${SQUID_PROXY_PORT}
  which AI agents write literally without expansion, causing Maven
  NumberFormatException

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants