.pr_agent_accepted_suggestions - TACC/Core-CMS GitHub Wiki

Templates access settings.PORTAL_BLOG_SHOW_BYLINE, but django_settings_export only exposes variables listed in SETTINGS_EXPORT. Because PORTAL_BLOG_SHOW_BYLINE is missing from that list, the template condition will evaluate falsy and never display the byline.

• django_settings_export.settings_export is enabled as a template context processor.
• SETTINGS_EXPORT_VARIABLE_NAME is set to settings and SETTINGS_EXPORT enumerates which keys are accessible in templates.

• taccsite_cms/settings/settings.py[720-743]
• Add 'PORTAL_BLOG_SHOW_BYLINE' to SETTINGS_EXPORT (near the other PORTAL_BLOG_SHOW_* keys).

share_on_social.html injects {{ url }} directly into query parameters (Facebook/LinkedIn/Bluesky) and mailto: body without URL encoding. Any URL containing special characters (e.g. /news/?tag=a&b=c#section) will break the generated share link.

Sharing is now enabled by default via PORTAL_SOCIAL_SHARE_PLATFORMS, increasing the likelihood this bug is hit in production.

• taccsite_cms/templates/share_on_social.html[3-56]
• Build the URL via request.build_absolute_uri (or include request.get_full_path) and apply |urlencode when embedding into query parameters (e.g. ...?u={{ url|urlencode }} and mailto:?body={{ url|urlencode }}).
• taccsite_cms/settings/settings.py[290-295]
• (Optional) Keep defaults, but verify share links work for URLs with query strings/fragments after encoding changes.

Default configuration includes 'instagram' but the share template does not implement an Instagram share link, so the platform is ignored. This creates a mismatch between settings and rendered output and can produce a UI stub (prefix text, no icons) for certain configurations.

share_on_social.html currently supports: facebook, linkedin, bluesky, email.

• taccsite_cms/settings/settings.py[290-295]
• Remove 'instagram' from the default list or replace it with a supported platform.
• taccsite_cms/templates/share_on_social.html[6-57]
• (Optional hardening) Adjust logic so the prefix only renders when at least one supported platform link will render, and/or handle unknown platforms explicitly.

taccsite_cms/settings/settings.py contains a bare identifier PORTAL_BLOG_SHOW_MAIN_IMAGE with no assignment, which triggers a NameError during settings import and blocks Django startup and management commands.

Django imports settings at startup and for commands like python manage.py test ... and python manage.py collectstatic --no-input, so this import-time NameError breaks the documented verification workflow (PR Compliance ID 5). The stray line may have been accidentally left behind during a rename involving PORTAL_BLOG_SHOW_ABSTRACT_TAG.

• taccsite_cms/settings/settings.py[315-327]

After renaming the setting, the templates and exported settings now use PORTAL_BLOG_TAG_FOR_EXTERNAL_ARTICLES. However, the deprecated-settings remapping code still converts legacy TACC_BLOG_SHOW_ABSTRACT_TAG into PORTAL_BLOG_SHOW_ABSTRACT_TAG, meaning legacy overrides won’t affect the new behavior.

• Templates read settings.PORTAL_BLOG_TAG_FOR_EXTERNAL_ARTICLES.
• SETTINGS_EXPORT exports PORTAL_BLOG_TAG_FOR_EXTERNAL_ARTICLES.
• Deprecated remapping currently only performs a generic TACC_ → PORTAL_ rename, which produces the old portal key (PORTAL_BLOG_SHOW_ABSTRACT_TAG).

• taccsite_cms/settings/settings.py[680-703]
• taccsite_cms/settings/settings.py[723-744]

In the deprecated remapping loop, special-case TACC_BLOG_SHOW_ABSTRACT_TAG to set PORTAL_BLOG_TAG_FOR_EXTERNAL_ARTICLES (and optionally also set PORTAL_BLOG_SHOW_ABSTRACT_TAG as an alias for extra compatibility). Alternatively, remove TACC_BLOG_SHOW_ABSTRACT_TAG from the deprecated remap list if you explicitly want to drop backward support, but then ensure documentation reflects that behavior clearly.

@tacc/core-styles is pinned to GitHub, but npm resolves it to a git+ssh://[email protected]/... URL, requiring SSH credentials. This can break npm ci in CI/dev environments.

The project’s setup/build scripts run npm ci inside a vanilla Node container; no SSH credentials/config are established by the repo.

• package.json[23-25]
• package-lock.json[1405-1408]

• Change the dependency spec to an HTTPS git URL (or set git-protocol=https via .npmrc) so the lock resolves to git+https://....
• Regenerate package-lock.json to ensure resolved uses HTTPS, then re-run npm ci in the documented container flow.

The footer links set identical aria-label values that override link text, causing screen readers to announce indistinguishable links.

This footer is included site-wide via base.html.

• taccsite_cms/templates/footer.html[3-6]

• Remove the aria-label attributes entirely (letting the visible link text become the accessible name), OR
• Make each aria-label unique and descriptive, e.g. "Texas Advanced Computing Center (opens in a new window)", OR
• Prefer adding an accessible hint via visually-hidden text/aria-describedby instead of replacing the accessible name.

@tacc/core-styles is specified via github: which is currently being locked as git+ssh://[email protected]/... in package-lock.json. This makes npm ci fail in Docker/CI environments that do not have GitHub SSH credentials.

The Docker image build runs npm ci, which strictly uses package-lock.json.

• package.json[23-25]
• package-lock.json[1405-1410]
• Dockerfile[39-46]

1. Change the dependency spec to an HTTPS-based git URL (and preferably a full commit SHA), e.g. git+https://github.com/TACC/Core-Styles.git#<full_sha>.
2. Re-run npm install to regenerate package-lock.json so the resolved field is no longer git+ssh://....
3. Verify docker build succeeds without injecting SSH keys.

The dependency is pinned with a short commit SHA in package.json, which is less explicit than the full commit hash.

package-lock.json already contains the full 40-character commit hash for this dependency.

• package.json[23-25]

Replace github:TACC/Core-Styles#9bc64ca with github:TACC/Core-Styles#9bc64cab17108a89775eae0cd2d6f5d8ea4ef870 (or switch to an HTTPS git URL while doing this), then ensure package-lock.json remains consistent.

The dropdown menu container was changed to <nav class="dropdown-menu"> and no longer has role="menu", but the child links still use role="menuitem". This produces invalid ARIA semantics (menuitems without a menu) and may be flagged by accessibility tooling.

• The header already uses a <nav id="s-header">; introducing nested <nav> elements for each dropdown can also add landmark noise.
• The toggle change from <a role="button"> to <button> is good and can remain.

• taccsite_cms/templates/cms_menu.html[33-51]

Option A (minimal change):

• Change <nav class="dropdown-menu" ...> back to <div class="dropdown-menu" role="menu" ...> (matching prior semantics). Option B (Bootstrap-style semantics):
• Keep the container element/tag, but remove role="menuitem" from the <a> elements (and keep aria-labelledby), so links are announced as normal links.

docker-compose.dev.yml was upgraded to ES 7.17.9 to avoid the documented cgroups v2 crash, but docker-compose.example-cms.yml (used by make example) still pins 7.17.0.

make example uses docker-compose.example.yml, which extends docker-compose.example-cms.yml for the Elasticsearch service.

• docker-compose.example-cms.yml[32-34]
• docker-compose.example.yml[21-24]
• Makefile[27-30]

docker-compose.dev.yml was upgraded to ES 7.17.9 to avoid the documented cgroups v2 crash, but docker-compose.example-cms.yml (used by make example) still pins 7.17.0.

make example uses docker-compose.example.yml, which extends docker-compose.example-cms.yml for the Elasticsearch service.

• docker-compose.example-cms.yml[32-34]
• docker-compose.example.yml[21-24]
• Makefile[27-30]

AGENTS.md says Postgres ./conf/postgres/*.secret files “can be ignored”, but docker-compose.dev.yml bind-mounts them from gitignored paths and bin/setup-cms.sh doesn’t create them. This contradiction makes first-time setup brittle.

• The secret files are gitignored, so new clones won’t have them.
• The dev compose currently bind-mounts them anyway.

• docker-compose.dev.yml[22-26]
• docker-compose.example-cms.yml[22-26]
• bin/setup-cms.sh[118-123]
• AGENTS.md[40-41]
• .gitignore[37-38]

AGENTS.md says Postgres ./conf/postgres/*.secret files “can be ignored”, but docker-compose.dev.yml bind-mounts them from gitignored paths and bin/setup-cms.sh doesn’t create them. This contradiction makes first-time setup brittle.

• The secret files are gitignored, so new clones won’t have them.
• The dev compose currently bind-mounts them anyway.

• docker-compose.dev.yml[22-26]
• docker-compose.example-cms.yml[22-26]
• bin/setup-cms.sh[118-123]
• AGENTS.md[40-41]
• .gitignore[37-38]