docs(self-managed): publish 0.6.1-rc snapshot#375
Conversation
Signed-off-by: Stephanie Baum <sbaum@nvidia.com>
📝 WalkthroughWalkthroughAdds a selectable ChangesDocumentation snapshot
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)docs/v0.6.1-rc/samples/configs/cp-env-eks-example.yamlTraceback (most recent call last): docs/v0.6.1-rc/samples/configs/cp-example-secrets.yamlTraceback (most recent call last): docs/v0.6.1-rc/samples/configs/local-dev-env.yamlTraceback (most recent call last):
Comment |
|
🌿 Preview your docs: https://nvidia-preview-docs-0-6-1-rc.docs.buildwithfern.com/nvcf |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Note
Due to the large number of review comments, Critical severity comments were prioritized as inline comments.
🟠 Major comments (51)
docs/v0.6.1-rc/api.md-182-204 (1)
182-204: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAdd the required bearer authorization header.
The direct
/v1/keysrequest omitsAuthorization: Bearer <admin-JWT>. The corresponding client implementation insrc/clis/nvcf-cli/internal/apikeys/client.goLines 137-207 sends this header, so this documented command will fail unless it authenticates the request.Proposed fix
+export NVCF_TOKEN=$(jq -r .token ~/.nvcf-cli.state) + curl -s -X POST "http://${GATEWAY_ADDR}/v1/keys" \ -H "Host: api-keys.${GATEWAY_ADDR}" \ -H "Content-Type: application/json" \ + -H "Authorization: Bearer ${NVCF_TOKEN}" \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/api.md` around lines 182 - 204, Add the required Authorization header to the documented POST request for /v1/keys, using the admin JWT in Bearer format, consistent with the header construction in the apikey client implementation. Keep the existing request headers and payload unchanged.docs/v0.6.1-rc/metrics/invocation-service/metrics.md-5-8 (1)
5-8: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winFix the malformed PromQL selectors.
The endpoint selector should use
^/v2/nvcf.*|^/health$; the current\*,\|, and\$escaping is incorrect for the displayed PromQL. Line 8 also has an extra quote:namespace=""astro-tenant....🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/metrics/invocation-service/metrics.md` around lines 5 - 8, Update the PromQL selectors for axum_http_requests_total, axum_http_requests_duration_seconds_count, and axum_http_requests_duration_seconds_sum to use ^/v2/nvcf.*|^/health$ without the incorrect backslash escapes. Correct the app_invocation_error namespace value by removing the extra leading quote while preserving the intended namespace.docs/v0.6.1-rc/cluster-management/configuration.md-269-278 (1)
269-278: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winCorrect the network-policy names in the table.
The table contains names such as
allow-egress-internet-no- internal-no-apiandallow-ingress-monitoring- gxcache, but the actual ConfigMap key later isallow-egress-internet-no-internal-no-api. Remove the embedded spaces so operators can match the documented names to the resources they patch.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/cluster-management/configuration.md` around lines 269 - 278, Correct the network-policy names in the policy table by removing embedded spaces, including changing allow-egress-internet-no- internal-no-api to allow-egress-internet-no-internal-no-api, allow-egress-prometheus- nvcf-byoo to allow-egress-prometheus-nvcf-byoo, and allow-ingress-monitoring- gxcache to allow-ingress-monitoring-gxcache. Ensure all names match their corresponding ConfigMap keys.docs/v0.6.1-rc/cli.md-623-633 (1)
623-633: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAvoid putting secrets in command-line arguments.
--secrets,--secret,--password, and similar values are exposed through shell history and process inspection. Document a supported stdin/file/secret-store alternative, or clearly warn users not to use these forms with real credentials.Also applies to: 964-977
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/cli.md` around lines 623 - 633, Update the CLI documentation examples using --secrets, --secret, --password, or similar sensitive options, including the additional referenced example, to clearly warn against passing real credentials as command-line arguments. Document a supported stdin, file, or secret-store alternative if one exists; otherwise retain the example only with an explicit security warning.docs/v0.6.1-rc/cli.md-151-161 (1)
151-161: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDo not present plaintext HTTP as the default remote configuration.
These examples send
NVCF_TOKENand API keys throughhttp://to a remote load balancer. Restrict HTTP to localhost/isolated test networks and make HTTPS the required default for remote gateways; add an explicit warning beside both examples.Also applies to: 203-224
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/cli.md` around lines 151 - 161, Update the remote gateway examples in the configuration documentation, including base_http_url, invoke_url, and api_keys_service_url, to use https:// by default. Add explicit warnings beside both relevant examples that plaintext HTTP is only appropriate for localhost or isolated test networks, while retaining HTTP guidance only as a clearly restricted alternative.docs/v0.6.1-rc/cluster-management/container-cache.md-21-24 (1)
21-24: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winAllow the registry username variable to expand.
Single quotes pass the literal
${REGISTRY_USERNAME}to Helm, causing registry authentication to fail. Use double quotes for the username.echo "${REGISTRY_PASSWORD}" | helm registry login ${REGISTRY} \ - --username '${REGISTRY_USERNAME}' --password-stdin + --username "${REGISTRY_USERNAME}" --password-stdin🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/cluster-management/container-cache.md` around lines 21 - 24, Update the helm registry login command so the REGISTRY_USERNAME variable expands at runtime by changing its single-quoted argument to a double-quoted argument, while preserving the existing REGISTRY and REGISTRY_PASSWORD handling.docs/v0.6.1-rc/cluster-management/gxcache.md-368-371 (1)
368-371: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUse the installed chart reference instead of
..The earlier installation commands use a repository or OCI chart, but this upgrade command only works when run from a local chart directory. Users following the documented flow will otherwise receive a chart-not-found error.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/cluster-management/gxcache.md` around lines 368 - 371, Update the helm upgrade example to reference the installed repository or OCI chart used by the preceding installation commands instead of the local chart path “.”, while preserving the existing namespace, values, and metrics settings.docs/v0.6.1-rc/cluster-management/gxcache.md-22-23 (1)
22-23: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winExpand
REGISTRY_USERNAMEinstead of passing it literally.Single quotes prevent shell expansion, so Helm receives the literal
${REGISTRY_USERNAME}. Use double quotes and quote the registry argument as well.Proposed fix
-echo "${REGISTRY_PASSWORD}" | helm registry login ${REGISTRY} \ - --username '${REGISTRY_USERNAME}' --password-stdin +echo "${REGISTRY_PASSWORD}" | helm registry login "${REGISTRY}" \ + --username "${REGISTRY_USERNAME}" --password-stdin🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/cluster-management/gxcache.md` around lines 22 - 23, Update the helm registry login command to expand REGISTRY_USERNAME by using double quotes, and quote the REGISTRY argument as well. Preserve the existing password-stdin behavior and registry login flow.docs/v0.6.1-rc/cluster-management/monitoring.md-111-121 (1)
111-121: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDon't inline
LS_ACCESS_TOKENin the patch example. The CRD storesaccessTokenas a plain string, so write the patch to a 0600 temp file and pass it with--patch-fileinstead; otherwise the token is exposed in process args and shell history.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/cluster-management/monitoring.md` around lines 111 - 121, The tracing configuration example should not interpolate LS_ACCESS_TOKEN into the kubectl command. Update the patch flow to generate a temporary patch file containing the access token with permissions restricted to 0600, then apply it using kubectl’s --patch-file option while preserving the existing cluster name and configuration fields.Source: Coding guidelines
docs/v0.6.1-rc/container-functions.md-94-97 (1)
94-97: 🚀 Performance & Scalability | 🟠 Major | ⚡ Quick winReduce the direct-run worker default.
A default of 500 Uvicorn workers can spawn hundreds of processes when the example is run without
WORKER_COUNT, exhausting CPU and memory. Use a small default such as1or4.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/container-functions.md` around lines 94 - 97, Update the direct-run uvicorn.run configuration to default WORKER_COUNT to a small worker count such as 1 or 4 instead of 500, while preserving the environment variable override.docs/v0.6.1-rc/container-functions.md-82-92 (1)
82-92: 🚀 Performance & Scalability | 🟠 Major | ⚡ Quick winDo not block the FastAPI event loop.
echois declaredasyncbut callstime.sleep, blocking the event loop for every non-streaming request. Useawait asyncio.sleep(...), or make the handler synchronous.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/container-functions.md` around lines 82 - 92, Update the async echo handler to avoid blocking the FastAPI event loop: replace the non-streaming branch’s time.sleep call with an awaited asyncio.sleep, and ensure the required asyncio import is present. Preserve the existing streaming behavior and response calculation.docs/v0.6.1-rc/container-functions.md-268-287 (1)
268-287: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winMatch the inference URL to the bound model name.
The PyTriton server binds the model as
timed_sleeper, but function creation uses/v2/models/my_model_image/infer. Invocations will target a model that does not exist; use/v2/models/timed_sleeper/inferor rename the bound model.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/container-functions.md` around lines 268 - 287, Update the NVCF function creation example’s inferenceUrl to match the PyTriton-bound model name timed_sleeper, using the corresponding /v2/models/timed_sleeper/infer endpoint. Keep the remaining function configuration unchanged.docs/v0.6.1-rc/container-functions.md-108-123 (1)
108-123: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRun both example containers as non-root.
The page states that root containers are unsupported, but both Dockerfiles omit
USERand therefore run as root by default. Add a dedicated unprivileged user and grant it ownership of the application/model paths before settingUSER.Also applies to: 216-242
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/container-functions.md` around lines 108 - 123, Add a dedicated unprivileged user to both example Dockerfiles, grant that user ownership of the application and model paths after they are copied or created, and set USER before the container command. Ensure both examples run their existing CMD as the non-root user while preserving the current application behavior.docs/v0.6.1-rc/cluster-management/self-managed.md-459-464 (1)
459-464: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDo not print credential material.
These commands print the first 20 characters of bearer tokens and API keys, which can leak credential material into terminal history, CI logs, or support captures. Remove the token/key output and print only a non-sensitive success message.
As per coding guidelines, do not log secrets, tokens, credentials, or full user-data request bodies.
Also applies to: 513-537
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/cluster-management/self-managed.md` around lines 459 - 464, The self-managed setup instructions must not print any portion of the generated NVCF token or API key. Remove the `${NVCF_TOKEN:0:20}` interpolation from the success output near the token-generation commands and the corresponding occurrences in the additionally referenced section, replacing them with a non-sensitive success message while leaving token assignment unchanged.Source: Coding guidelines
docs/v0.6.1-rc/cluster-management/self-managed.md-450-453 (1)
450-453: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUse route hostnames separately from the gateway address.
GATEWAY_ADDRis used as both the URL destination and the HTTPHostvalue. In the documented configuration, routing requires names such asapi.<STACK_DOMAIN>,api-keys.<STACK_DOMAIN>, and<function-id>.invocation.<STACK_DOMAIN>. Using an IP or load-balancer hostname as theHostheader will not match those routes.Also applies to: 472-475, 492-495, 513-518, 541-545
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/cluster-management/self-managed.md` around lines 450 - 453, The self-managed cluster-management instructions incorrectly use GATEWAY_ADDR for both the request destination and HTTP Host routing. Update the documented commands around GATEWAY_ADDR and the referenced sections to keep the gateway address as the URL destination while setting Host to the appropriate route hostname, such as api.<STACK_DOMAIN>, api-keys.<STACK_DOMAIN>, or <function-id>.invocation.<STACK_DOMAIN>.docs/v0.6.1-rc/container-tasks.md-115-125 (1)
115-125: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRemove or correct the unsupported result-upload workflow.
The page says result upload is not supported in this release, but immediately instructs users to set
UPLOADand retrieve results. This creates a guaranteed or misleading workflow. Remove the example until supported, or mark it as future functionality.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/container-tasks.md` around lines 115 - 125, Correct the “Result handling” section in the container-tasks documentation by removing the unsupported UPLOAD workflow and task-results retrieval example, or clearly marking it as future functionality. Ensure the section no longer instructs users to configure UPLOAD or run nvcf-cli task results in this release.docs/v0.6.1-rc/cluster-management/self-managed.md-641-657 (1)
641-657: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winGuard cluster-wide CRD deletion.
Deleting these CRDs removes the definitions and all matching resources cluster-wide, including resources from other NVCF installations sharing the cluster. Restrict this procedure to a dedicated cluster and require an explicit confirmation before deletion.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/cluster-management/self-managed.md` around lines 641 - 657, Update the CRD deletion procedure in the self-managed cluster teardown instructions to state that it is only safe on a dedicated cluster and affects all matching resources cluster-wide. Add an explicit confirmation step or prompt immediately before the kubectl CRD deletion command, requiring the operator to acknowledge the destructive scope before proceeding.docs/v0.6.1-rc/observability.md-125-133 (1)
125-133: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winResolve the tracing availability contradiction.
This page simultaneously says tracing is GA, says OTLP tracing is planned for a future release, and provides enablement instructions. Choose the actual release status: either document the supported configuration and remove the “planned” text, or remove the configuration workflow until tracing is available.
Also applies to: 230-266
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/observability.md` around lines 125 - 133, Resolve the contradictory tracing status in the “Tracing (Available in GA)” section and the related configuration workflow around global.observability.tracing. Align the heading, feature description, and enablement instructions with the actual release status: document supported OTLP tracing without planned/future-release wording if available, or remove the configuration instructions and mark tracing unavailable if not.docs/v0.6.1-rc/registry-allowlist.md-47-59 (1)
47-59: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winDo not delete all running API pods after every upgrade.
The Helm upgrade changes the pod template and should trigger a Deployment rollout. This label selector can delete every currently running API pod, causing avoidable downtime. Remove the deletion step and wait for
kubectl rollout status; if a restart is genuinely required, restart the Deployment explicitly with an availability-safe procedure.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/registry-allowlist.md` around lines 47 - 59, Remove the kubectl delete pod command from the “Step 2: Wait for the rollout” instructions. Keep kubectl rollout status as the standard post-upgrade step, and only document an explicitly availability-safe Deployment restart if a restart is genuinely required.docs/v0.6.1-rc/quickstart.md-157-161 (1)
157-161: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winUse
--password-stdinhere.-p "${NGC_API_KEY}"exposes the key in shell history and process listings; pipe the key intohelm registry logininstead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/quickstart.md` around lines 157 - 161, Update the NGC registry login command in the quickstart documentation to use Helm’s --password-stdin option, piping NGC_API_KEY through standard input instead of passing it with -p. Preserve the existing registry, username, and authentication behavior.docs/v0.6.1-rc/example-dashboards.md-119-131 (1)
119-131: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winPin Helm and kubectl operations to the control-plane context.
This section supports split-topology deployments but relies on the ambient Kubernetes context. A user whose current context is the GPU cluster could install the observability stack there, contrary to the instructions. Use
--kube-contextconsistently or explicitly switch contexts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/example-dashboards.md` around lines 119 - 131, Update the split-topology Helm command to explicitly target the control-plane Kubernetes context using --kube-context, and ensure any kubectl operations in this section use the same context rather than relying on the ambient context.docs/v0.6.1-rc/control-plane-operations.md-221-228 (1)
221-228: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUse the deployment resource name from the service table.
The table identifies the NVCF API deployment as
nvcf-api, but this example checksdeployment/api, which can fail withNotFound. Usedeployment/nvcf-api.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/control-plane-operations.md` around lines 221 - 228, Update the kubectl rollout status command in the Helm upgrade example to target deployment/nvcf-api, matching the deployment resource name defined in the service table; leave the namespace and timeout unchanged.docs/v0.6.1-rc/example-dashboards.md-334-337 (1)
334-337: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDo not recommend
admin/admincredentials.This encourages insecure Grafana access. Direct users to retrieve the configured admin secret or set a unique credential during installation; never present default credentials as an expected login path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/example-dashboards.md` around lines 334 - 337, Update the “Grafana login issues” documentation to remove the admin/admin recommendation. Direct users to retrieve the configured Grafana admin secret or set a unique credential during installation, without presenting default credentials as an expected login path.docs/v0.6.1-rc/csp-end-to-end-example-installation.md-554-556 (1)
554-556: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winProtect and remove the generated kubeconfig.
config view --raw --flattencan write bearer tokens or client keys intocompute-kubeconfig.yamlin the current directory. Add restrictive permissions (chmod 600), warn users not to commit it, and delete it after registration/install.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/csp-end-to-end-example-installation.md` around lines 554 - 556, Update the kubeconfig generation steps around COMPUTE_KUBECONFIG to apply chmod 600 immediately after creation, explicitly warn users not to commit the generated file, and remove it after registration/install completes.docs/v0.6.1-rc/release-notes/0.6.0.md-78-89 (1)
78-89: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winCover every NVCA version below 2.51.0.
The prose requires an intermediate upgrade for all versions older than
2.51.0, while the table only covers2.50.5 or older. Add the omitted2.50.xversions or change the prose to match the supported matrix.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/release-notes/0.6.0.md` around lines 78 - 89, Align the NVCA upgrade matrix with the prose by covering every version below 2.51.0, including all 2.50.x releases. Update the table row currently labeled “2.50.5 or older” to represent the full supported range, while preserving the required intermediate upgrade and health verification steps.docs/v0.6.1-rc/release-notes/0.5.0-to-0.6.0-upgrade.md-78-89 (1)
78-89: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winCover every NVCA version below 2.51.0 in the upgrade matrix.
The prose applies to all versions older than
2.51.0, but the table only lists2.50.5 or older, omitting versions such as2.50.6through2.50.9. Those users could incorrectly skip the required intermediate upgrade.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/release-notes/0.5.0-to-0.6.0-upgrade.md` around lines 78 - 89, The upgrade matrix must cover every NVCA version below 2.51.0, not only versions 2.50.5 and older. Update the table in the upgrade-notes content to include the omitted 2.50.6–2.50.9 range while preserving the required intermediate-upgrade guidance.docs/v0.6.1-rc/runbooks/caches.md-41-54 (1)
41-54: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winAdd safeguards before deleting cache PVCs.
Deleting the PVC permanently discards the cache and does not guarantee automatic recreation for arbitrary workloads. Require verification of ownership/reclaim policy, confirm cache data loss is acceptable, and distinguish StatefulSet-managed PVCs from manually managed storage.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/runbooks/caches.md` around lines 41 - 54, Update the cache recovery runbook to add explicit safeguards before the PVC deletion command: verify PVC ownership and reclaim policy, confirm cache data loss is acceptable, and distinguish StatefulSet-managed PVCs from manually managed storage. Clarify that automatic PVC recreation should only be expected for the applicable StatefulSet workflow, not arbitrary workloads, and adjust the subsequent pod-recreation guidance accordingly.docs/v0.6.1-rc/control-plane-operations.md-231-234 (1)
231-234: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winCorrect the Helm value-retention guidance.
helm upgradenormally reuses the previous release values unless--reset-valuesis supplied; omitting-fdoes not itself reset everything to chart defaults. Explain the actual behavior while still recommending an explicit values file for reproducibility.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/control-plane-operations.md` around lines 231 - 234, Update the Helm upgrade guidance in the Info block to state that helm upgrade reuses the previous release values by default and only resets them when --reset-values is specified. Continue recommending an explicit -f values.yaml file for reproducibility, and retain the advice to back up current values with helm get values when the original file is unavailable.docs/v0.6.1-rc/runbooks/control-plane-key-rotation-mek.md-38-47 (1)
38-47: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftDo not interpolate the root token into
sh -ccommand strings.This places the OpenBAO root token in process arguments inside the pod and risks exposure through process inspection or diagnostics. Pass credentials through a safer mechanism, preferably short-lived least-privilege authentication rather than the root token.
Also applies to: 53-56, 85-90, 108-110, 133-139, 145-147, 159-161, 200-206
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/runbooks/control-plane-key-rotation-mek.md` around lines 38 - 47, Update the runbook commands that invoke bao through sh -c, including the current MEK read and referenced sections, to avoid interpolating VAULT_TOKEN into command strings or pod process arguments. Use a safer credential-passing mechanism, preferably short-lived least-privilege authentication, while preserving the documented key-rotation operations.docs/v0.6.1-rc/example-dashboards.md-257-260 (1)
257-260: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winScope cleanup to resources owned by this release.
--all -Adeletes every Fluent Bit and OpenTelemetry Collector resource across the cluster, and deleting the entireobservabilitynamespace can destroy unrelated workloads. Target release-owned resources/namespaces and require an explicit confirmation before namespace deletion.Also applies to: 284-286
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/example-dashboards.md` around lines 257 - 260, Restrict the cleanup commands in the dashboard documentation to Fluent Bit and OpenTelemetry Collector resources owned by this release, rather than using --all -A across the cluster. Scope namespace cleanup to the release-owned observability namespace/resources, and add an explicit confirmation requirement before deleting that namespace. Apply the same changes to the corresponding commands around the second referenced section.docs/v0.6.1-rc/control-plane-operations.md-125-138 (1)
125-138: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winRestore the original replica count after maintenance.
Scaling every service back to
--replicas=1can silently reduce highly available deployments to a single replica. Capture the current count before scaling down and restore it afterward.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/control-plane-operations.md` around lines 125 - 138, Update the maintenance scaling instructions to capture the deployment’s existing replica count before the scale-down operation, then restore that captured count instead of hardcoding --replicas=1. Keep the rollout verification step after restoration.docs/v0.6.1-rc/samples/configs/cp-example-secrets.yaml-21-23 (1)
21-23: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRemove the predictable Cassandra password default.
This sample is presented as required configuration, but
ch@ng3m3is usable and not marked for replacement. A copy-paste deployment would expose Cassandra to a known credential. Require a unique supplied/generated value instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/samples/configs/cp-example-secrets.yaml` around lines 21 - 23, Remove the hard-coded DEFAULT_CASSANDRA_PASSWORD value from the sample configuration and require it to be supplied or generated uniquely through the existing secrets mechanism. Preserve the DEFAULT_CASSANDRA_PASSWORD key while eliminating the predictable fallback credential.docs/v0.6.1-rc/samples/scripts/force-cleanup-nvcf.sh-35-57 (1)
35-57: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winRequire explicit confirmation for destructive cleanup.
The default path immediately deletes Helm releases and other cluster resources. Make dry-run the default or require an explicit
--confirmacknowledgement before destructive actions execute.As per coding guidelines, “Never delete clusters, Helm releases, worktrees, secrets, or artifact directories without explicit user confirmation.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/samples/scripts/force-cleanup-nvcf.sh` around lines 35 - 57, Update the argument parsing and cleanup flow in force-cleanup-nvcf.sh so destructive actions require explicit confirmation: either make dry-run the default or add a --confirm option that must be supplied before deletion proceeds. Preserve --dry-run as a non-destructive path and ensure Helm releases and other cluster resources are never deleted without the explicit acknowledgement.Source: Coding guidelines
docs/v0.6.1-rc/grpc-invocation-enablement.md-68-82 (1)
68-82: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDocument DNS for the worker callback endpoint.
The sample uses
grpc.<domain-or-service>:10086, but the linked Gateway DNS procedure does not create agrpc.<domain>record. Document that record pointing to the Gateway address, or use the Gateway address/service DNS explicitly; otherwise split-cluster workers cannot resolve the callback endpoint.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/grpc-invocation-enablement.md` around lines 68 - 82, Update the grpcproxy configuration example in the gRPC invocation enablement documentation to use a resolvable worker callback endpoint: either document the required grpc.<domain> DNS record pointing to the Gateway address or replace the placeholder URL with the explicit Gateway address/service DNS, ensuring split-cluster workers can resolve it.docs/v0.6.1-rc/gateway-routing.md-662-724 (1)
662-724: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDocument a reachable TLS gRPC listener.
The quickstart creates gRPC TCP on
10081, but the production client example changes togrpc.<domain>:443without showing the required Gateway listener, TLS configuration, and route attachment. As written, TLS clients have no deployable path togrpc-proxy.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/gateway-routing.md` around lines 662 - 724, Update the TLS configuration section around “Step 4: Configure TLS” to document a deployable HTTPS/TLS gRPC listener for grpc-proxy, including the listener port, TLS certificate configuration, and attachment of the gRPC route to the Gateway. Ensure the documented listener supports the Step 5 client endpoint grpc.nvcf.example.com:443 and preserves routing to grpc-proxy.docs/v0.6.1-rc/troubleshooting.md-44-50 (1)
44-50: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDo not recommend
set -xfor migration debugging. Command tracing writes expanded credentials and tokens to pod logs.
docs/v0.6.1-rc/troubleshooting.md#L44-L50: replace theset -xinstruction with targeted, redacted diagnostics.docs/v0.6.1-rc/troubleshooting.md#L421-L428: remove the duplicatedset -xrecommendation and use the same safe diagnostic approach.As per coding guidelines, “Do not log secrets, tokens, credentials, or full user-data request bodies; redact or omit them.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/troubleshooting.md` around lines 44 - 50, Replace the set -x migration-debugging guidance at docs/v0.6.1-rc/troubleshooting.md lines 44-50 with targeted diagnostics that redact or omit credentials, tokens, secrets, and full request bodies; also remove the duplicate set -x recommendation at lines 421-428 and apply the same safe diagnostic approach there.Source: Coding guidelines
docs/v0.6.1-rc/streaming-functions.md-325-331 (1)
325-331: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDo not log any portion of the API key.
Line 326 exposes token fragments in container logs. Remove this line; log only that an API key was configured. As per coding guidelines, “Do not log secrets, tokens, credentials, or full user-data request bodies; redact or omit them.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/streaming-functions.md` around lines 325 - 331, Remove the API key fragment output from the “Launching intermediate proxy” logging block. Replace it with a non-sensitive message indicating only that an API key is configured, while preserving the other startup details such as Function ID, server, and proxy settings.Source: Coding guidelines
docs/v0.6.1-rc/helm-tasks.md-35-40 (1)
35-40: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winMake the self-hosted example disable result upload.
This example sets
resultHandlingStrategytoUPLOAD, but the task-creation guide states uploads are unsupported on self-hosted NVCF. The copied command will fail validation instead of running the task. UseNONEand omitresultsLocation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/helm-tasks.md` around lines 35 - 40, Update the self-hosted task example’s result configuration by changing resultHandlingStrategy from UPLOAD to NONE and removing resultsLocation. Leave the remaining task settings unchanged.docs/v0.6.1-rc/troubleshooting.md-846-868 (1)
846-868: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winRequire explicit confirmation before destructive cleanup.
The default execution path force-deletes workloads, Helm releases, namespaces, and CRDs. Make
--dry-runthe default and require an explicit--confirm/--yesflag before any deletion. As per coding guidelines, “Never delete clusters, Helm releases, worktrees, secrets, or artifact directories without explicit user confirmation.”Also applies to: 878-1005
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/troubleshooting.md` around lines 846 - 868, Make the cleanup script represented by the argument parser default to dry-run mode, and add an explicit --confirm/--yes option that enables destructive execution. Update the usage text and argument handling around DRY_RUN so every workload, Helm release, namespace, and CRD deletion path is gated by that confirmation, while preserving the existing preview behavior and rejecting unknown options.Source: Coding guidelines
docs/v0.6.1-rc/streaming-functions.md-131-147 (1)
131-147: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRemove the extra JSON closing brace.
Line 146 closes the request object, then Line 147 adds another
}. Thecurlpayload is invalid JSON and function creation fails.Proposed fix
"description": "'$STREAMING_FUNCTION_NAME'", "functionType": "STREAMING" - } }'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/streaming-functions.md` around lines 131 - 147, Remove the redundant closing JSON brace at the end of the curl payload in the streaming function creation example, leaving exactly one closing brace for the request object after the functionType field so the payload remains valid JSON.docs/v0.6.1-rc/third-party-registries.md-151-176 (1)
151-176: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUse
repository/*whenREPO_PREFIX="*"
repository/'"${REPO_PREFIX}"'/*becomesrepository/*/*for the all-repositories case, which misses simple repository names. Userepository/*when the prefix is*, and keep the prefix-scoped form otherwise.
docs/v0.6.1-rc/third-party-registries.md#L151-L176docs/v0.6.1-rc/third-party-registries.md#L187-L219🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/third-party-registries.md` around lines 151 - 176, Update the IAM policy examples in docs/v0.6.1-rc/third-party-registries.md at lines 151-176 and 187-219: when REPO_PREFIX is "*", use the resource ARN suffix repository/*; otherwise retain the prefix-scoped repository/<prefix>/* form. Apply this conditional resource construction consistently in both affected examples.docs/v0.6.1-rc/infrastructure-sizing.md-87-99 (1)
87-99: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winUse three OpenBao nodes for the stated HA tier.
The component table describes OpenBao as a three-replica HA Raft cluster, but the Minimal High Availability tier provisions only two nodes while claiming full redundancy. Set this tier to three OpenBao nodes, or explicitly downgrade the tier’s HA guarantee and adjust the total node count.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/infrastructure-sizing.md` around lines 87 - 99, Update the Minimal High Availability table to provision 3 OpenBao nodes, matching the documented three-replica HA Raft cluster and full redundancy guarantee. Recalculate the tier’s total node count from 7 to 8 control-plane nodes.docs/v0.6.1-rc/lls-installation.md-560-568 (1)
560-568: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winInclude or link the cleanup script before instructing users to run it.
The guide tells users to save and execute
lls-nlb-cleanup.sh, but no script contents or repository path are provided in this document. Add the script to the snapshot or link to an existing tracked script; otherwise the documented cleanup flow cannot be completed.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/lls-installation.md` around lines 560 - 568, Update the “Step 2: Delete Manual NLB Resources” section to include the complete lls-nlb-cleanup.sh script or link directly to an existing tracked script before the chmod and execution commands, ensuring users have access to the referenced cleanup script.docs/v0.6.1-rc/lls-installation.md-412-416 (1)
412-416: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDo not hardcode the configurable UDP port.
The guide allows
LLS_UDP_PORTto change, but the Helm values example always setslbPort: "5004". A user selecting another port will create mismatched listener, security-group, and pod configuration. Use a placeholder that must be replaced or explicitly instruct users to substitute$LLS_UDP_PORT.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/lls-installation.md` around lines 412 - 416, Update the Helm values example near lbPort to avoid hardcoding "5004": use a clearly replaceable UDP-port placeholder or explicitly reference the LLS_UDP_PORT value configured in Step 2.1, while preserving the requirement that lbPort matches the listener, security group, and pod configuration.docs/v0.6.1-rc/image-mirroring.md-518-526 (1)
518-526: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winDo not delete every repository matching the prefix.
This troubleshooting command force-deletes all ECR repositories beginning with
nvcf-self-hosted, including unrelated images or charts. Limit deletion to explicitly named failed artifacts and add a confirmation/dry-run step before destructive removal.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/image-mirroring.md` around lines 518 - 526, Replace the broad repository-prefix deletion pipeline in the image-mirroring troubleshooting instructions with deletion of only explicitly named failed artifacts. Add a dry-run or confirmation step that lists the targeted repositories before invoking force deletion, and ensure unrelated repositories, images, and charts are not removed.docs/v0.6.1-rc/http-load-testing.md-142-147 (1)
142-147: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUse the gateway address plus the invocation
Hostheader.For local deployments,
${FUNCTION_ID}.invocation.localhostis not a usable route. The repository’sexamples/load-tests/functions/supreme_http_test.jssupports self-managed routing throughINVOKE_HOST, but this guide never sets or passes it. Usehttp://${GATEWAY_ADDR}/echo, exportINVOKE_HOST=invocation.${GATEWAY_ADDR}, pass it to k6, and add the sameHostheader to the curl example at Lines 248-253.Proposed fix
- export HTTP_SUPREME_NVCF_URL="http://${FUNCTION_ID}.invocation.${GATEWAY_ADDR}/echo" + export INVOKE_HOST="invocation.${GATEWAY_ADDR}" + export HTTP_SUPREME_NVCF_URL="http://${GATEWAY_ADDR}/echo" ... -e HTTP_SUPREME_NVCF_URL=${HTTP_SUPREME_NVCF_URL} \ + -e INVOKE_HOST=${INVOKE_HOST} \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/http-load-testing.md` around lines 142 - 147, Update the local self-managed HTTP example to use http://${GATEWAY_ADDR}/echo, export INVOKE_HOST=invocation.${GATEWAY_ADDR}, and pass INVOKE_HOST into the k6 load test configuration. Also update the curl example to send the same invocation.${GATEWAY_ADDR} value as its Host header, while preserving the configured inference path.docs/v0.6.1-rc/lls-installation.md-466-480 (1)
466-480: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDefine the AWS variables used by the Helm command. Step 2 exports
REGION, but this block still uses unsetAWS_REGIONandAWS_ACCOUNT_ID, so the ECR login and OCI URL will be wrong unless those are defined elsewhere. Export them here or switch this block to the existingREGIONvariable and add the account ID input.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/lls-installation.md` around lines 466 - 480, Update the ECR authentication and Helm OCI command to use variables that are defined in the installation flow: either replace AWS_REGION with the existing REGION and define AWS_ACCOUNT_ID before these commands, or explicitly export both AWS_REGION and AWS_ACCOUNT_ID in this block. Ensure the same resolved region and account ID are used for both the registry login and chart URL.docs/v0.6.1-rc/image-mirroring.md-89-93 (1)
89-93: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winUse
--password-stdinfor the NGC login.
-p <NGC_API_KEY>puts the secret on the command line; pipe$NGC_API_KEYintodocker login nvcr.io -u '$oauthtoken' --password-stdininstead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/image-mirroring.md` around lines 89 - 93, Update the Docker login command in the image mirroring instructions to avoid passing the NGC API key via the command line. Pipe the NGC API key into docker login and use --password-stdin while preserving the existing registry and username.docs/v0.6.1-rc/http-soak-testing.md-43-48 (1)
43-48: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUse
--pushfor the multi-arch build, or switch to a single-platform--loadbuild.docker buildx build --platform linux/amd64,linux/arm64won’t create a local image for the laterdocker tagstep, so this sequence fails as written. If you want a multi-arch publish, push directly frombuildxand drop thedocker tag/docker pushcommands.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/http-soak-testing.md` around lines 43 - 48, The multi-architecture build sequence must publish directly because buildx does not load a multi-platform image locally. Update the “Build (multi-arch)” commands to use buildx with --push and the target registry image tag, then remove the subsequent docker tag and docker push commands; alternatively, change the build to a single-platform --load flow if local tagging is required.docs/v0.6.1-rc/lls-installation.md-159-166 (1)
159-166: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winMake the target group type consistent
The target group is documented as
Instance, but Step 2.7 creates it with--target-type ip, and Step 4.2 registers node IPs. Change this section toip, or update the commands to use instance IDs instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/lls-installation.md` around lines 159 - 166, Make the Target Group documentation consistent with the implementation by changing the documented Target type from Instance to ip, matching the --target-type ip command and node IP registration described in Steps 2.7 and 4.2.docs/v0.6.1-rc/http-soak-testing.md-171-180 (1)
171-180: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winFail fast on missing soak-test inputs.
API_KEYis still documented as optional here, but the script and env table treat it as required.FUNCTIONSalso falls back to[]on missing or invalid JSON, so the soak can run for the full duration without sending traffic. Add startup checks forBASE_URL,INVOKE_HOST,FUNCTIONS, andAPI_KEYbefore k6 starts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/http-soak-testing.md` around lines 171 - 180, Update the soak-test startup configuration and environment table so BASE_URL, INVOKE_HOST, FUNCTIONS, and API_KEY are all required. Before k6 starts, validate that each variable is present and that FUNCTIONS contains valid, non-empty JSON array data; fail immediately with a clear error instead of defaulting to an empty array or running without traffic.
🧹 Nitpick comments (1)
docs/v0.6.1-rc/function-creation.md (1)
44-45: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winClarify Secret delivery guidance.
Kubernetes Secrets do not automatically make environment-variable delivery safer; Secret values can still be exposed through process inspection or debugging. Recommend storing sensitive values in Secrets, avoiding hardcoding, and mounting them as files where practical.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/v0.6.1-rc/function-creation.md` around lines 44 - 45, Update the secret-management guidance near the Kubernetes Secrets recommendation to state that sensitive values should be stored in Secrets and never hardcoded, while clarifying that Kubernetes Secrets do not inherently secure environment-variable delivery. Recommend mounting secrets as files where practical, and retain the existing non-root container guidance unchanged.
2 participants
TL;DR
Publish a selectable
0.6.1-rcdocumentation version as a direct copy of the0.6.0snapshot.Additional Details (optional for docs, build, test, refactor, ci, chore, style, and revert PRs)
The
0.6.1-rcrelease candidate needs a versioned documentation route withoutchanging the qualified
0.6.0content.This change:
docs/v0.6.0todocs/v0.6.1-rc0.6.1-rcversion label andv0.6.1-rcslug0.6.0as the default stable documentation versionNo dependencies changed. License review and NOTICE updates are not required.
For the Reviewer
Verify that
docs/v0.6.1-rcremains identical todocs/v0.6.0and that thenew Fern version does not replace the stable default.
For QA (optional for docs, build, test, refactor, ci, chore, style, and revert PRs)
QA is not needed.
Validation performed:
diff -qr docs/v0.6.0 docs/v0.6.1-rcfern/versions/v0.6.1-rc.ymlexists./tools/ci/check-docsgit diff --checkreports three trailing-whitespace lines inherited fromdocs/v0.6.0. They are preserved to keep the new snapshot an exact copy.Issues
Closes #374
Checklist
Summary by CodeRabbit