update build-and-deploy, dependabot

.github/dependabot.yml

@@ -8,6 +8,10 @@ updates:
       default-days: 7
       semver-minor-days: 2
       semver-patch-days: 2
+    groups:
+      docusaurus:
+        patterns:
+          - "@docusaurus/*"
 
   - package-ecosystem: "github-actions"
     directory: "/"

.github/workflows/build-and-deploy.yml

@@ -53,7 +53,7 @@ jobs:
           uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
         - name: Set up Node.js
-          uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+          uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
           with:
             node-version: '22.x'
 
@@ -62,15 +62,15 @@ jobs:
           run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
 
         - name: Cache Node.js dependencies
-          uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+          uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
           with:
             path: ${{ steps.npm-cache-dir.outputs.dir }}
             key: v2-${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
             restore-keys: |
               v2-${{ runner.os }}-node-
 
         - name: Cache Docusaurus build
-          uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+          uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
           id: cache-build
           with:
             path: |
@@ -80,7 +80,7 @@ jobs:
               v2-${{ runner.os }}-docusaurus-
 
         - name: Cache webpack
-          uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+          uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
           with:
             path: node_modules/.cache
             key: v2-${{ runner.os }}-webpack-${{ hashFiles('**/package-lock.json') }}
@@ -103,7 +103,7 @@ jobs:
             NODE_ENV: ${{ needs.determine-environment.outputs.environment }}
 
         - name: Upload artifact for deployment
-          uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+          uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
           with:
             name: build-output
             path: build/
@@ -192,6 +192,47 @@ jobs:
 
           echo "All MIME types set successfully!"
 
+      - name: Set public URL metadata on blobs
+        env:
+          APP_EXTERNAL_URL: ${{ secrets.APP_EXTERNAL_URL || vars.APP_EXTERNAL_URL }}
+        run: |
+          if [[ -z "$APP_EXTERNAL_URL" ]]; then
+            echo "APP_EXTERNAL_URL not configured, skipping public URL metadata"
+            exit 0
+          fi
+          PUBLIC_URL="${APP_EXTERNAL_URL%/}"
+
+          echo "Setting public_url metadata on blobs (base: $PUBLIC_URL)..."
+
+          ACCOUNT="${{ secrets.STORAGE_ACCOUNT_NAME }}"
+          KEY="${{ secrets.STORAGE_ACCOUNT_KEY }}"
+
+          blob_count=0
+          az storage blob list \
+            --account-name "$ACCOUNT" \
+            --account-key "$KEY" \
+            --container-name '$web' \
+            --query "[].name" -o tsv | \
+          while IFS= read -r blob; do
+            az storage blob metadata update \
+              --account-name "$ACCOUNT" \
+              --account-key "$KEY" \
+              --container-name '$web' \
+              --name "$blob" \
+              --metadata "public_url=${PUBLIC_URL}/${blob}" \
+              --output none &
+
+            blob_count=$((blob_count + 1))
+            # Run up to 20 concurrent updates, then wait for the batch
+            if (( blob_count % 20 == 0 )); then
+              wait
+              echo "  Processed $blob_count blobs..."
+            fi
+          done
+          wait
+
+          echo "Public URL metadata set on all blobs"
+
       - name: Purge CDN endpoint (if configured)
         run: |
           if [[ -n "${{ secrets.CDN_ENDPOINT_NAME }}" ]] && [[ -n "${{ secrets.CDN_PROFILE_NAME }}" ]] && [[ -n "${{ secrets.CDN_RESOURCE_GROUP }}" ]]; then

.github/workflows/reindex-algolia.yml

@@ -64,7 +64,7 @@ jobs:
           fi
 
       - name: Algolia crawler creation and crawl
-        uses: algolia/algoliasearch-crawler-github-actions@79db67cd7284bf4623324cd69e3cba49c7a85c4c # v1
+        uses: algolia/algoliasearch-crawler-github-actions@3ae4def15d82c60aa02b0e528b50167593cbaaf6 # v1.1.13
         id: algolia_crawler
         with:
           crawler-user-id: ${{ secrets.ALGOLIA_CRAWLER_USER_ID }}
@@ -78,7 +78,7 @@ jobs:
       - name: Get workflow run details
         if: github.event_name == 'workflow_run'
         id: get-pr
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -105,7 +105,7 @@ jobs:
           github.event_name == 'workflow_run' && 
           steps.get-pr.outputs.pr_found == 'true' &&
           steps.algolia_crawler.outcome == 'success'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/sync-dev-to-main.yml

@@ -202,7 +202,7 @@ jobs:
 
       - name: Create GitHub issue for conflict
         if: steps.check-new-commits.outputs.has_new_commits == 'true' && steps.merge.outputs.conflict == 'true'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const conflictedFiles = require('fs').readFileSync('conflicts.txt', 'utf8');