feat(ci): add lychee broken link test

.github/workflows/sphinxbuild.yml

@@ -185,22 +185,6 @@ jobs:
         with:
           path: artifacts/
 
-      # ========================================================================
-      # PREPARE FOR LINK VALIDATION: BUILD FULL PAGE CONTEXT
-      # ========================================================================
-      # We need to validate links in the new documentation, but some links may
-      # point to other versions or branches that are already deployed. So we:
-      # 1. Fetch the existing gh-pages content (old versions)
-      # 2. Merge in the new artifacts (what we're about to deploy)
-      # 3. Run link checks only on the NEW content, but with full context
-      # ========================================================================
-      - name: Checkout gh-pages branch for validation context
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: gh-pages
-          fetch-depth: 1
-          path: validation-context
-
       # ========================================================================
       # DETERMINE DEPLOYMENT TARGETS (branch_name and version_name)
       # ========================================================================
@@ -307,8 +291,7 @@ jobs:
       # ========================================================================
       # UPLOAD STAGING ARTIFACTS
       # ========================================================================
-      # Upload the staging folder for use in deploy job.
-      # This makes the content visible in the UI for debugging and inspection.
+      # Upload the staging folder for use in both the deploy and link-check jobs.
       # ========================================================================
       - name: Upload staged artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -317,6 +300,53 @@ jobs:
           path: stage/
           retention-days: 1
 
+  # ============================================================================
+  # LINK CHECK
+  # ============================================================================
+  # Runs in parallel with deploy. Downloads the staged artifacts, strips
+  # canonical links, then runs lychee against the new content only.
+  # ============================================================================
+  link-check:
+    name: Check for broken links
+    needs: stage-and-check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download staged artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: staged-docs
+          path: stage/
+
+      - name: Strip canonical links from validation HTML
+        run: |
+          find "stage/${{ needs.stage-and-check.outputs.branch_name }}" -name '*.html' -print0 | while IFS= read -r -d '' f; do
+            perl -0pi -e 's{^\s*<link rel="canonical" href="https://docs\.nextcloud\.com/server/[^"]*" />\n}{}m' "$f"
+          done
+          ls -la stage/*
+
+      # We need to exclude certain links from the check:
+      # - go.php: This is a special redirect page
+      # - mailto: links: These are not valid URLs and will always fail
+      # - 404.html: This is not necessary
+      # - latest/stable/xx links from the version selector
+      - name: Check for broken links with lychee
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
+        with:
+          fail: true
+          token: ${{ secrets.GITHUB_TOKEN }}
+          jobSummary: true
+          args: |
+            --root-dir "$(pwd)/stage"
+            --offline --no-progress
+            --remap "https://docs.nextcloud.com/server/ file://$(pwd)/stage/"
+            --exclude 'go\.php' --exclude 'mailto:' --exclude-path '.*/404\.html' --exclude-path '.*/_static/.*'
+            --exclude "/user_manual/" --include "/user_manual/en/"
+            --exclude '^file://.*/stage/(latest|stable|[0-9]+)/(developer_manual|admin_manual|user_manual)/?$'
+            'stage/${{ needs.stage-and-check.outputs.branch_name }}/user_manual/en/**/*.html'
+            'stage/${{ needs.stage-and-check.outputs.branch_name }}/admin_manual/**/*.html'
+            'stage/${{ needs.stage-and-check.outputs.branch_name }}/developer_manual/**/*.html'
+
   # ============================================================================
   # DEPLOY
   # ============================================================================
@@ -460,7 +490,7 @@ jobs:
           GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }}
 
   summary:
-    needs: [build-html, build-pdf, stage-and-check, deploy]
+    needs: [stage-and-check, link-check, deploy]
     runs-on: ubuntu-latest-low
     if: always()
 
@@ -474,10 +504,9 @@ jobs:
         run: |
           if ${{ github.event_name == 'pull_request' }}
           then
-            echo "This workflow ran for a pull request. We need build-html, build-pdf and stage-and-check to succeed, but deploy will be skipped"
-            if ${{ needs.build-html.result != 'success' || needs.build-pdf.result != 'success' || needs.stage-and-check.result != 'success' || needs.deploy.result != 'skipped' }}; then exit 1; fi
+            echo "This workflow ran for a pull request. We need stage-and-check and link-check to succeed, but deploy will be skipped"
+            if ${{ needs.stage-and-check.result != 'success' || needs.link-check.result != 'success' || needs.deploy.result != 'skipped' }}; then exit 1; fi
           else
             echo "This workflow ran for a push. We need all jobs to succeed, including deploy"
-            if ${{ needs.build-html.result != 'success' || needs.build-pdf.result != 'success' || needs.stage-and-check.result != 'success' || needs.deploy.result != 'success' }}; then exit 1; fi
+            if ${{ needs.stage-and-check.result != 'success' || needs.link-check.result != 'success' || needs.deploy.result != 'success' }}; then exit 1; fi
           fi
-

admin_manual/configuration_database/mysql_4byte_support.rst

@@ -11,11 +11,9 @@ installation needs to be tweaked a bit.
 
 .. warning::
 
-    This manual only covers MySQL 8 or newer and MariaDB 10.2 or newer.
-    If you use MariaDB 10.2, please check
-    `this older version <https://docs.nextcloud.com/server/20/admin_manual/configuration_database/mysql_4byte_support.html#mariadb-10-2-or-earlier>`_
-    of the documentation. If you use an older version of MySQL or MariaDB, please note that they are no longer supported
-    by the current Nextcloud version.
+    This guide applies only to MySQL 8 or newer and MariaDB 10.6 or newer.
+    For a list of supported MySQL and MariaDB versions, see our
+    :doc:`system requirements documentation <../installation/system_requirements>`.
 
 1. Make sure the following InnoDB settings are set on your MySQL server::
 

admin_manual/configuration_files/big_file_upload_configuration.rst

@@ -172,5 +172,5 @@ enough for PHP, webservers or any load balancers involved.
 Federated Cloud Sharing
 -----------------------
 
-If you are using `Federated Cloud Sharing <https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/federated_cloud_sharing_configuration.html>`_ and want to share large files, you can increase the timeout values for requests to the federated servers.
+If you are using :doc:`Federated Cloud Sharing <federated_cloud_sharing_configuration>` and want to share large files, you can increase the timeout values for requests to the federated servers.
 Therefore, you can set ``davstorage.request_timeout`` in your ``config.php``. The default value is 30 seconds.

admin_manual/configuration_files/encryption_configuration.rst

@@ -389,6 +389,6 @@ Further Reading
 - :ref:`occ Command Reference: Encryption <encryption_label>`
 - `How Nextcloud uses encryption to protect your data <https://nextcloud.com/blog/encryption-in-nextcloud/>`_
 - `Technical impact of Authenticated Encryption <https://hackerone.com/reports/108082>`_
-- `Nextcloud SSE Implementation Details <encryption_details.html>`_
+- :doc:`Nextcloud SSE Implementation Details <encryption_details>`
 - `Nextcloud Encryption (SSE & E2EE) Recovery Tools <https://github.com/nextcloud/encryption-recovery-tools>`_
 - `Nextcloud E2EE Server API App (required for E2EE usage) <https://github.com/nextcloud/end_to_end_encryption/>`_

admin_manual/configuration_files/encryption_details.rst

@@ -346,7 +346,7 @@ Sources
 -------
 
 - `encryption-recovery-tools repository on GitHub <https://github.com/nextcloud/encryption-recovery-tools>`_
-- `Nextcloud Encryption Configuration documentation <https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html>`_
+- :doc:`Nextcloud Encryption Configuration documentation <encryption_configuration>`
 - `Nextcloud Help response concerning the usage of version information <https://help.nextcloud.com/t/allow-file-decryption-with-only-the-files-keys-and-passwords/436/12>`_
 - `Sourcecode: Creation of the Message Authentication Code <https://github.com/nextcloud/server/blob/a374d8837d6de459500e619cf608e0721ea14574/apps/encryption/lib/Crypto/Crypt.php#L504>`_
 - `Sourcecode: Derivation of the Encryption Key <https://github.com/nextcloud/server/blob/a374d8837d6de459500e619cf608e0721ea14574/apps/encryption/lib/Crypto/Crypt.php#L346>`_

admin_manual/configuration_files/external_storage/webdav.rst

@@ -10,8 +10,8 @@ You need the following information:
 * Folder name: The name of your local mountpoint.
 * The URL of the WebDAV or Nextcloud server.
 * Username and password for the remote server
-* Secure https://: We always recommend https:// for security, though you can 
-  leave this unchecked for http://.
+* Secure ``https://``: We always recommend ``https://`` for security, though you can 
+  leave this unchecked for ``http://``.
 
 Optionally, a ``Remote Subfolder`` can be specified to change the destination
 directory. The default is to use the whole root.

admin_manual/installation/example_ubuntu.rst

@@ -14,7 +14,7 @@ following commands in a terminal::
 
 * This installs the packages for the Nextcloud core system. 
   If you are planning on running additional apps, keep in mind that they might
-  require additional packages.  See `Prerequisites for manual installation <https://docs.nextcloud.com/server/latest/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation>`_ for details.
+  require additional packages.  See :ref:`Prerequisites for manual installation <prerequisites_label>` for details.
 
 Now you need to create a database user and the database itself by using the
 MySQL command line interface. The database tables will be created by Nextcloud

admin_manual/office/configuration.rst

@@ -8,7 +8,7 @@ Nextcloud Office App Settings
 Collabora Online Server
 ***********************
 
-URL (and port) of the Collabora Online server that provides the editing functionality as a WOPI client. Collabora Online should use the same protocol (http:// or https://) as the server installation. Naturally, https:// is recommended.
+URL (and port) of the Collabora Online server that provides the editing functionality as a WOPI client. Collabora Online should use the same protocol (``http://`` or ``https://``) as the server installation. Naturally, ``https://`` is recommended.
 
 Restrict usage to specific groups
 *********************************

developer_manual/app_publishing_maintenance/publishing.rst

@@ -52,7 +52,7 @@ Be technically sound
 Respect the users
 ^^^^^^^^^^^^^^^^^
 
-* Apps have to follow design and `HTML/CSS layout guidelines <../html_css_design/css.html>`_.
+* Apps have to follow design and :doc:`HTML/CSS layout guidelines <../html_css_design/css>`.
 * Apps correctly clean up after themselves on uninstall and correctly handle up- and downgrades.
 * Apps clearly communicate their intended purpose and active features, including features introduced through updates.
 * Apps respect the users' choices and do not make unexpected changes, or limit users' ability to revert them. For example, they do not remove other apps or disable settings.

developer_manual/basics/controllers.rst

@@ -838,7 +838,7 @@ To turn off checks the following *Attributes* can be added before the controller
 * ``#[NoAdminRequired]``: Also users that are not admins can access the page
 * ``#[PublicPage]``: Everyone can access the page without having to log in
 * ``#[NoTwoFactorRequired]``: A user can access the page before the two-factor challenge has been passed (use this wisely and only in two-factor auth apps, e.g. to allow setup during login)
-* ``#[NoCSRFRequired]``: Don't check the CSRF token (use this wisely since you might create a security hole; to understand what it does see `CSRF in the security section <../prologue/security.html#cross-site-request-forgery>`__)
+* ``#[NoCSRFRequired]``: Don't check the CSRF token (use this wisely since you might create a security hole; to understand what it does see :ref:`CSRF in the security section <csrf_introduction>`)
 
 .. note::
 

developer_manual/basics/storage/filesystem.rst

@@ -7,7 +7,7 @@ Nextcloud filesystem API
 
 High level guide to using the Nextcloud filesystem API.
 
-Because users can choose their storage backend, the filesystem should be accessed by using the appropriate filesystem classes. For a simplified filesystem for app specific data see `IAppData <appdata.html>`_
+Because users can choose their storage backend, the filesystem should be accessed by using the appropriate filesystem classes. For a simplified filesystem for app specific data see :doc:`IAppData <appdata>`
 
 Node API
 ^^^^^^^^

developer_manual/digging_deeper/config/appconfig.rst

@@ -22,9 +22,7 @@ In addition to simple read/write operations, ``IAppConfig`` supports:
 .. _appconfig_concepts:
 
 .. note::
-   See `Lexicon Concepts`_ to learn more about **Lexicon**, a way to define configuration keys and avoid conflicts in your code.
-
-.. _Lexicon Concepts: https://docs.nextcloud.com/server/latest/developer_manual/digging_deeper/config/lexicon.html#concept-overview
+   See :ref:`Lexicon Concepts <concept-overview>` to learn more about **Lexicon**, a way to define configuration keys and avoid conflicts in your code.
 
 
 AppFramework

developer_manual/digging_deeper/config/lexicon.rst

@@ -7,6 +7,8 @@ Lexicon
 Since v32, Nextcloud provides a way to centralize the definition of your app's configuration keys and values in a single place.
 
 
+.. _concept-overview:
+
 Concept overview
 ----------------
 

developer_manual/digging_deeper/config/userconfig.rst

@@ -16,9 +16,7 @@ On top of storing and accessing your configuration values, ``IUserConfig`` comes
 .. _userconfig_concepts:
 
 .. note::
-	See `Lexicon Concepts`_ to learn more about **Lexicon**, a way to fully define your configuration keys and avoid conflict when using it in your code.
-
-.. _Lexicon Concepts: https://docs.nextcloud.com/server/latest/developer_manual/digging_deeper/config/lexicon.html#concept-overview
+	See :ref:`Lexicon Concepts <concept-overview>` to learn more about **Lexicon**, a way to fully define your configuration keys and avoid conflict when using it in your code.
 
 
 Typed Config Values

developer_manual/getting_started/coding_standards/index.rst

@@ -16,7 +16,7 @@ General
   You describe what you want to do, ask feedback on the direction you take it and take it from there.
 * When you are finished, use the merge request function on GitHub to create a pull request.
   The other developers will look at it and give you feedback. You can signify that your PR is ready for review by adding the label "3. to review" to it.
-  See `the code review page for more information <../prologue/bugtracker/codereviews.html>`_
+  See :doc:`the code review page for more information <../../prologue/bugtracker/codereviews>`
 * It is key to keep changes separate and small. The bigger and more hairy a PR grows, the harder it is to get it in.
   So split things up where you can in smaller changes - if you need a small improvement like a API addition for a big feature addition, get it in first rather than adding it to the big piece of work!
 * Decisions are made by consensus. We strive for making the best technical decisions and as nobody can know everything, we collaborate.

user_manual/desktop/uninstallation.rst

@@ -12,7 +12,7 @@ In each operating system:
 
 2. *Uninstall* the desktop client.
 
-3. You may also need to take into consideration that uninstalling the desktop client will not remove the `user's configuration <https://docs.nextcloud.com/server/latest/admin_manual/desktop/configfile.html#configuration-file>`_ file and synced data.
+3. You may also need to take into consideration that uninstalling the desktop client will not remove the :doc:`user's configuration <configfile>` file and synced data.
 
     For data removal (sync folders), consider using the server feature `remote wipe <https://nextcloud.com/de/blog/nextcloud-desktop-client-2-6-1-brings-remote-wipe-dark-mode-support-to-mac-os-x-and-more/>`_. This feature is available across all clients.
 
@@ -30,7 +30,7 @@ There are two ways of removing the desktop client:
 
    msiexec /uninstall Nextcloud-x.y.z-x64.msi /quiet``
 
-3. The `user's configuration <https://docs.nextcloud.com/server/latest/admin_manual/desktop/configfile.html#configuration-file>`_ is located at ``%APPDATA%\Nextcloud\nextcloud.cfg``.
+3. The :doc:`user's configuration <configfile>` is located at ``%APPDATA%\Nextcloud\nextcloud.cfg``.
 
 macOS
 ^^^^^
@@ -53,7 +53,7 @@ Beyond deleting the desktop client from the *Applications* folder, you may also
    rm -rf "$HOME/Library/Preferences/Nextcloud"  
    rm -f  "$HOME/Library/Preferences/com.nextcloud.desktopclient.plist"
 
-3. From version 33.0.0 the `user's configuration <https://docs.nextcloud.com/server/latest/admin_manual/desktop/configfile.html#configuration-file>`_ is located at ``$HOME/Library/Containers/com.nextcloud.desktopclient/Data/Library/Preferences/Nextcloud/nextcloud.cfg``. 
+3. From version 33.0.0 the :doc:`user's configuration <configfile>` is located at ``$HOME/Library/Containers/com.nextcloud.desktopclient/Data/Library/Preferences/Nextcloud/nextcloud.cfg``.
    On older versions it is located at ``$HOME/Library/Preferences/Nextcloud/nextcloud.cfg``.
 
 Linux
@@ -68,5 +68,5 @@ It depends on how you installed the desktop client:
 
    sudo apt remove nextcloud-desktop
 
-3. The `user's configuration <https://docs.nextcloud.com/server/latest/admin_manual/desktop/configfile.html#configuration-file>`_ is located at *$HOME/.config/Nextcloud/nextcloud.cfg*.
+3. The :doc:`user's configuration <configfile>` is located at *$HOME/.config/Nextcloud/nextcloud.cfg*.
 

user_manual/files/access_webdav.rst

@@ -92,8 +92,7 @@ You can access files in Linux operating systems using the following methods.
 Nautilus file manager
 ^^^^^^^^^^^^^^^^^^^^^
 
-**When you configure your Nextcloud account in the** `GNOME Control Center
-<../groupware/sync_gnome.html>`_, **your files will automatically be mounted
+**When you configure your Nextcloud account in the** :doc:`GNOME Control Center <../groupware/sync_gnome>`, **your files will automatically be mounted
 by Nautilus as a WebDAV share, unless you deselect file access**.
 
 You can also mount your Nextcloud files manually. Use the ``davs://``
@@ -222,7 +221,7 @@ path of your certificate as in this example::
 Accessing files using macOS
 ---------------------------
 
-.. note:: The macOS Finder suffers from a `series of implementation problems <http://sabre.io/dav/clients/finder/>`_ and should only be used if the Nextcloud server runs on **Apache** and **mod_php**, or **Nginx 1.3.8+**. Alternative macOS-compatible clients capable of accessing WebDAV shares include open source apps like `Cyberduck <https://cyberduck.io/>`_ (see instructions `here <https://docs.nextcloud.com/server/latest/user_manual/files/access_webdav.html#accessing-files-using-cyberduck>`_) and `Filezilla <https://filezilla-project.org>`_. Commercial clients include `Mountain Duck <https://mountainduck.io/>`_, `Forklift <https://binarynights.com/>`_, `Transmit <https://panic.com/>`_, and `Commander One <https://mac.eltima.com/>`_.
+.. note:: The macOS Finder suffers from a `series of implementation problems <http://sabre.io/dav/clients/finder/>`_ and should only be used if the Nextcloud server runs on **Apache** and **mod_php**, or **Nginx 1.3.8+**. Alternative macOS-compatible clients capable of accessing WebDAV shares include open source apps like `Cyberduck <https://cyberduck.io/>`_ (see instructions `here <#accessing-files-using-cyberduck>`_) and `Filezilla <https://filezilla-project.org>`_. Commercial clients include `Mountain Duck <https://mountainduck.io/>`_, `Forklift <https://binarynights.com/>`_, `Transmit <https://panic.com/>`_, and `Commander One <https://mac.eltima.com/>`_.
 
 To access files through the macOS Finder: