Standardize docs repos further

[eloquence]

Rather than having the Dependabot mechanics replicated x number of docs repos, could we treat one as the template repo, and apply lock file updates to all the others?

[legoktm]

Hmm, are you thinking like whenever Poetry.lock is modified in securedrop-dev-docs, it's manually or automatically copied to the other docs repos?

[eloquence]

Yep exactly.

[legoktm]

Here's what I'm imagining right now: we keep dependabot enabled on all repos, but only review+merge on -dev-docs, then after 2-3 days, some automation cherry-picks from -dev-docs to other docs repos so you still get commit history but review it all at once (and for review, you should be able to just diff it against -dev-docs). And dependabot-on-other-docs repos can be used for ASAP security fixes, otherwise it should automatically close once the update is applied through our automation.

[eloquence]

That feels fairly similar to current state, now that we're up-to-date across the board. Currently I can treat one repo's PRs as "review PRs", and then rubber-stamp the other repos' identical PRs if they do indeed match.

If we don't want to trust any fully automated process to push the lockfile to target repos, one other way I could see to get additional time savings would be to rearchitect the docs repos as submodules, or use some other strategy to only have a single copy of the lockfile.

[legoktm]

If we don't want to trust any fully automated process to push the lockfile to target repos

Hmm. I think we could have some automated cross-checking of hashes across repositories, let me think about it a bit more.

On a slightly different tangent...is there a reason we're using sphinx-from-pypi in the first place? Versus using Debian packages (and use containers for local development)? bookworm ships with sphinx 5.3 but I didn't think there were any 6.0 features we were looking to use / depend on. We'd lose the update churn entirely while still getting security updates at the cost of not getting new features on a regular basis.

[eloquence]

While I like the speed of the container-free local dev environment, I could certainly live with switching to a fully container-based approach and using system packages. Worth kicking around a bit at the team level I think.

If we stay with the current approach, it'd be nice to reduce/eliminate the amount of manual hash checking for every Dependabot alert across each of the repos.