Merge branch 'json-view/14b-view-float-layout' into json-view/15-view-bench

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/CONTRIBUTING.md

@@ -142,6 +142,16 @@ The documentation will then be available at <http://127.0.0.1:8000/>. See the do
 [mkdocs](https://www.mkdocs.org) and [Material for MkDocs](https://squidfunk.github.io/mkdocs-material/) for more
 information.
 
+Before opening a pull request, check the documentation like the CI does:
+
+```shell
+make build -C docs/mkdocs          # strict build: fails on broken links, anchors, and structure problems
+make check_mermaid -C docs/mkdocs  # checks the Mermaid diagrams (requires Node.js)
+```
+
+A new API page also needs an entry in [`docs/docset/docSet.sql`](https://github.com/nlohmann/json/blob/develop/docs/docset/docSet.sql),
+the search index of the docset; `make build` reports missing entries.
+
 ### Amalgamate the source code
 
 The single-header files

.github/dependabot.yml

@@ -18,6 +18,17 @@ updates:
     cooldown:
       default-days: 7
 
+  - package-ecosystem: npm
+    directory: /docs/mkdocs/scripts/mermaid
+    schedule:
+      interval: daily
+    cooldown:
+      default-days: 7
+    ignore:
+      # Material for MkDocs loads mermaid@11; keep the checker on the same major version
+      - dependency-name: mermaid
+        update-types: ["version-update:semver-major"]
+
   - package-ecosystem: pip
     directory: /tools/astyle
     schedule:

.github/workflows/cancel_closed_pr_runs.yml

@@ -0,0 +1,53 @@
+name: "Cancel runs of closed pull requests"
+
+# The concurrency groups of the other workflows cancel superseded runs when a
+# pull request gets new commits, but nothing stops the runs of its last commit
+# once the pull request is merged or closed. They then keep the runners busy
+# for hours while the queue of the open pull requests waits.
+#
+# pull_request_target is needed to get a token that can cancel runs for pull
+# requests from forks. This is safe because the workflow never checks out or
+# runs code from the pull request; it only calls the API.
+on:
+  pull_request_target:
+    types: [closed]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  cancel:
+    permissions:
+      actions: write
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: Cancel unfinished runs of the pull request's head commit
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          SELF: ${{ github.run_id }}
+        # only runs triggered by the pull request: when a branch is pushed to
+        # develop directly, its push runs share the head commit
+        run: |
+          gh api --paginate "repos/$GH_REPO/actions/runs?head_sha=$HEAD_SHA&per_page=100" \
+            --jq ".workflow_runs[]
+                  | select(.status != \"completed\" and .id != $SELF)
+                  | select(.event == \"pull_request\" or .event == \"pull_request_target\")
+                  | \"\(.id) \(.name)\"" |
+          while read -r id name; do
+            echo "Cancelling run $id ($name)"
+            # a run may finish between listing and cancelling; that is not an error
+            gh run cancel "$id" || true
+          done

.github/workflows/check_docs_links.yml

@@ -0,0 +1,46 @@
+name: Check documentation links
+
+# check the links of the documentation weekly; external links break without any change in this repository
+on:
+  schedule:
+    - cron: '17 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  check_docs_links:
+    if: github.repository == 'nlohmann/json'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install virtual environment
+        run: make install_venv -C docs/mkdocs
+
+      - name: Check links
+        shell: bash  # adds -o pipefail, so tee does not hide the exit code
+        run: make link_check -C docs/mkdocs 2>&1 | tee link_check.log
+
+      - name: Summarize broken links
+        if: failure()
+        run: |
+          {
+            echo '### Broken documentation links'
+            echo '```'
+            grep 'invalid url' link_check.log || true
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/codeql-analysis.yml

@@ -38,14 +38,14 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         languages: c-cpp
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

.github/workflows/flawfinder.yml

@@ -47,6 +47,6 @@ jobs:
           output: 'flawfinder_results.sarif'
 
       - name: Upload analysis results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: ${{github.workspace}}/flawfinder_results.sarif

.github/workflows/publish_documentation.yml

@@ -43,6 +43,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          # the git-revision-date-localized plugin needs the history for correct "last update" dates and so the
+          # strict build does not fail on a shallow clone
+          fetch-depth: 0
 
       - name: Install virtual environment
         run: make install_venv -C docs/mkdocs

.github/workflows/scorecards.yml

@@ -80,6 +80,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: results.sarif

.github/workflows/semgrep.yml

@@ -65,7 +65,7 @@ jobs:
 
       # Upload SARIF file generated in previous step
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: semgrep.sarif
         if: always()

.github/workflows/ubuntu.yml

@@ -400,7 +400,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        target: [ci_test_examples, ci_test_build_documentation]
+        target: [ci_test_examples, ci_test_build_documentation, ci_test_documentation_mermaid]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -410,6 +410,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          # the git-revision-date-localized plugin needs the history; a shallow clone makes the strict build fail
+          fetch-depth: ${{ matrix.target == 'ci_test_build_documentation' && '0' || '1' }}
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        if: matrix.target == 'ci_test_documentation_mermaid'
+        with:
+          node-version: 24
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build