feat(website): add Astro documentation site and CDK infrastructure

[macalbert]

Summary

Adds the Envilder documentation website built with Astro (i18n landing page) and AWS CDK infrastructure for deploying static websites via CloudFront and S3. Includes comprehensive unit tests for the CDK stacks, deployment handler, and domain models.

Changes

Website (src/apps/website/)

• Add Astro-based landing page with i18n support
• Add components: Hero, Navbar, Footer, Providers, GetStarted, HowItWorks, GitHubAction, Roadmap, Changelog, and more
• Add theme switcher (dark/light mode)
• Add public assets (AWS, Azure, GitHub Actions, NPM SVGs)

Infrastructure (src/iac/)

• Add CDK infrastructure for static website deployment (S3 + CloudFront + Route53)
• Add CI/CD buildspecs for production and test environments
• Add deployment configuration domain model with validation
• Add application versioning support
• Make subdomain optional for static websites

Testing ( ests/iac/)

• Add comprehensive unit tests for CloudFormation utilities and stacks
• Add tests for deployment logging, path resolution, and validation
• Add Jest configuration for IaC tests
• Update tsconfig and coverage collection configuration

Style & Refactoring

• Update UI styles for improved visual consistency and responsive Providers grid
• Improve readability of normalizeObjectValues utility
• Simplify expected values array in appEnvironment tests

Testing

• pnpm test passes
• pnpm lint passes
• Manual verification (if applicable)

---

Summary by CodeRabbit

Release Notes

• New Features
  • Launched website with multi-language support (English, Catalan, Spanish).
  • Added comprehensive documentation and changelog pages.
  • Implemented light and dark theme switching.
  • Created feature showcase, provider guides, and getting-started documentation.
  • Set up automated deployment infrastructure for reliable hosting.

[devin-ai-integration]

Devin Review found 2 new potential issues.

View 21 additional findings in Devin Review.

[devin-ai-integration]

🟡 Markdown-to-HTML converter corrupts fenced code block content via bold and inline-code regex passes

The changelogToHtml function at src/apps/website/src/utils/markdown.ts:70 processes regex replacements sequentially. The fenced code block handler (line 87-91) correctly escapes < and > inside <pre><code> blocks, but subsequent regex passes for bold (**...** at line 99) and inline code (`...` at line 101) still run on the already-processed output. This means patterns like **text** or `text` inside fenced code blocks are incorrectly converted to <strong>text</strong> or nested <code>text</code>, breaking the rendered HTML. The output is injected via Astro's set:html on changelog pages (src/apps/website/src/pages/changelog.astro:65). I confirmed this by running the regex chain: <pre><code>echo **hello**</code></pre> becomes <pre><code>echo <strong>hello</strong></code></pre>.

Prompt for agents

In src/apps/website/src/utils/markdown.ts, the changelogToHtml function (line 70) applies bold, inline-code, link, list-item, and paragraph regexes to the entire document AFTER fenced code blocks have been converted to <pre><code>...</code></pre>. This corrupts code block content. Fix by extracting fenced code blocks into placeholders before running inline transformations, then reinserting them afterward. For example: (1) Replace fenced code blocks with unique placeholder tokens like %%CODEBLOCK_0%%, storing each block's HTML in an array. (2) Run all the inline regex passes (bold, code, links, lists, paragraphs). (3) Replace the placeholder tokens back with the stored <pre><code>...</code></pre> HTML.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟡 Markdown link URLs inserted into href attributes without HTML-escaping double quotes (XSS)

The link replacement at src/apps/website/src/utils/markdown.ts:106 inserts the captured URL directly into an href attribute without escaping " characters: '<a href="$2" ...'. If a changelog link URL contains a double quote (e.g., [text](url"onmouseover="alert(1))), it breaks out of the attribute and injects arbitrary HTML attributes. The resulting HTML is rendered unsanitized via Astro's set:html directive on three changelog pages (changelog.astro:65, ca/changelog.astro:63, es/changelog.astro:63). While the attack surface is limited to content in the project's own docs/CHANGELOG.md, this is still an unsafe HTML generation pattern.

Suggested change

	.replace(
	/\[([^\]]+)\]\(([^)]+)\)/g,
	'<a href="$2" target="_blank" rel="noopener noreferrer">$1</a>',
	)
	.replace(
	/\[([^\]]+)\]\(([^)]+)\)/g,
	(_m, text, url) =>
	`<a href="${url.replace(/&/g, '&amp;').replace(/"/g, '&quot;')}" target="_blank" rel="noopener noreferrer">${text}</a>`,
	)

---

Was this helpful? React with 👍 or 👎 to provide feedback.