content: maintain docs about yubikey situation by Stensel8 · Pull Request #32 · THectic-NL/Zephyrus-Linux

Stensel8 · 2026-03-01T20:01:32Z

Summary

Maintaining some docs, because I changed my Yubikey setup and wanted to share it.

Type of change

content — update or improve existing content
chore — maintenance (dependencies, config, CI/CD)

Checklist

PR title follows the commit convention (e.g. fix: correct nmcli command in eduroam guide)
Both EN and NL versions updated (if applicable)
Media is in AVIF format (not PNG/JPG)
No broken image references (/images/*.avif all exist in static/images/)
Tested locally with hugo server

I want to improve my PR automations. The intended goal is to notify the user if something went wrong.

github-actions · 2026-03-01T20:06:29Z

Hey @Stensel8, looks like you forgot something!

The following images in static/images/ are not in AVIF format:

static/images/yubikey-gdm-password-config.png
static/images/yubikey-lockscreen.png
static/images/yubikey-polkit.png
static/images/yubikey-sudo-config.png
static/images/yubikey-sudo-test.png

Please convert them before merging. Install avifenc first:

sudo pacman -S libavif

Then batch-convert all images in static/images/:

cd static/images
for f in *.png *.jpg *.jpeg; do
  [ -f "$f" ] && avifenc -q 80 -s 6 "$f" "${f%.*}.avif" && rm "$f"
done

Copilot

Pull request overview

Updates the YubiKey security documentation (EN/NL) to reflect a shift away from FIDO2 LUKS unlock toward pam-u2f for sudo + GNOME lock screen, and adjusts CI workflows around image-format enforcement and PR checklist automation.

Changes:

Expanded YubiKey docs with pam-u2f configuration steps + troubleshooting context (EN/NL).
Added a “YubiKey FIDO2 LUKS unlock: USB timing race” entry to Known Issues (EN/NL).
Reworked CI image-format check to also comment on PRs + added a job to auto-tick the PR checklist; removed the auto-convert workflow.

Reviewed changes

Copilot reviewed 7 out of 12 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
static/images/yubikey-sudo-test.png	New screenshot asset (currently PNG).
static/images/yubikey-sudo-config.png	New screenshot asset (currently PNG).
static/images/yubikey-polkit.png	New screenshot asset (currently PNG).
static/images/yubikey-gdm-password-config.png	New screenshot asset (currently PNG).
content/docs/security/yubikey.md	Updated EN YubiKey guide; adds `pam-u2f` flow + image references.
content/docs/security/yubikey.nl.md	Updated NL YubiKey guide; adds `pam-u2f` flow + image references.
content/docs/known-issues.md	Added active issue entry for FIDO2 LUKS timing race (EN).
content/docs/known-issues.nl.md	Added active issue entry for FIDO2 LUKS timing race (NL).
.github/workflows/pr-checks.yml	Image-format job now outputs file list, comments on PR, and fails with annotations; adds “update checklist” job.
.github/workflows/convert-images.yml	Removed the auto-convert-to-AVIF workflow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-01T20:07:13Z

            --root-dir ./public
            public/**/*.html
          fail: true
+
+  # ── 8. Auto-tick PR checklist ────────────────────────────────────────────────
+  update-checklist:
+    name: Update PR checklist
+    runs-on: ubuntu-latest
+    if: always()
+    needs: [pr-title, bilingual, image-format, link-check]
+    steps:
+      - uses: actions/github-script@v7
+        env:
+          RESULT_PR_TITLE: ${{ needs.pr-title.result }}
+          RESULT_BILINGUAL: ${{ needs.bilingual.result }}
+          RESULT_IMAGE_FORMAT: ${{ needs.image-format.result }}
+          RESULT_LINK_CHECK: ${{ needs.link-check.result }}
+        with:
+          script: |
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+            });
+
+            let body = pr.body || '';
+
+            const setCheck = (keyword, passed) => {
+              body = body.replace(
+                new RegExp(`- \\[[ xX]\\] (.*${keyword}.*)`, 'i'),
+                `- [${passed ? 'x' : ' '}] $1`
+              );
+            };
+
+            setCheck('PR title follows',   process.env.RESULT_PR_TITLE    === 'success');
+            setCheck('Both EN and NL',     process.env.RESULT_BILINGUAL    === 'success');
+            setCheck('Media is in AVIF',   process.env.RESULT_IMAGE_FORMAT === 'success');
+            setCheck('No broken image',    process.env.RESULT_LINK_CHECK   === 'success');
+
+            await github.rest.pulls.update({
+              owner: context.repo.owner,


This job updates the PR body via the API, which requires pull-requests: write (and may be unavailable for forked PRs). Without explicit permissions and/or a fork check / error handling, this step can fail and make the workflow red even when the actual checks passed.

Copilot · 2026-03-01T20:07:13Z

+![nano editing /etc/pam.d/sudo with pam_u2f.so configured](/images/yubikey-sudo-config.avif)
+
+Test without closing the current terminal first:
+
+```bash


These markdown image links point to .avif files (yubikey-sudo-config.avif, yubikey-sudo-test.avif, yubikey-polkit.avif, yubikey-gdm-password-config.avif, yubikey-lockscreen.avif), but the images added in this PR are currently .png (and no corresponding .avif exists in static/images/). This will produce broken images and/or fail CI; please convert the images to AVIF and/or update the links to match the actual filenames.

Copilot · 2026-03-01T20:07:13Z

+            echo "found=false" >> "$GITHUB_OUTPUT"
+            echo "All images are AVIF."
          fi
-          echo "All images are AVIF."
+
+      - name: Post PR comment
+        if: steps.check.outputs.found == 'true'
+        uses: actions/github-script@v7
+        env:
+          FILES: ${{ steps.check.outputs.files }}
+          ACTOR: ${{ github.event.pull_request.user.login }}
+        with:
+          script: |
+            const files = process.env.FILES.trim().split('\n').map(f => `- \`${f}\``).join('\n');
+            const actor = process.env.ACTOR;
+            const body = [
+              `Hey @${actor}, looks like you forgot something!`,
+              '',
+              'The following images in `static/images/` are not in AVIF format:',
+              files,
+              '',
+              'Please convert them before merging. Install `avifenc` first:',
+              '```bash',
+              'sudo pacman -S libavif',
+              '```',
+              '',
+              'Then batch-convert all images in `static/images/`:',
+              '```bash',
+              'cd static/images',
+              'for f in *.png *.jpg *.jpeg; do',
+              '  [ -f "$f" ] && avifenc -q 80 -s 6 "$f" "${f%.*}.avif" && rm "$f"',
+              'done',
+              '```',
+            ].join('\n');
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,


actions/github-script calls here (creating an issue comment) require issues: write (and on some repos the default GITHUB_TOKEN is read-only). Without explicitly setting workflow/job permissions, this step can fail and make the whole check fail. Consider adding explicit permissions for this job/workflow and/or skipping/commenting logic when running on forked PRs where write scopes are unavailable.

Copilot · 2026-03-01T20:07:13Z

+            echo "found=false" >> "$GITHUB_OUTPUT"
+            echo "All images are AVIF."
          fi
-          echo "All images are AVIF."
+
+      - name: Post PR comment
+        if: steps.check.outputs.found == 'true'
+        uses: actions/github-script@v7
+        env:
+          FILES: ${{ steps.check.outputs.files }}
+          ACTOR: ${{ github.event.pull_request.user.login }}
+        with:
+          script: |
+            const files = process.env.FILES.trim().split('\n').map(f => `- \`${f}\``).join('\n');
+            const actor = process.env.ACTOR;
+            const body = [
+              `Hey @${actor}, looks like you forgot something!`,
+              '',
+              'The following images in `static/images/` are not in AVIF format:',
+              files,
+              '',
+              'Please convert them before merging. Install `avifenc` first:',
+              '```bash',
+              'sudo pacman -S libavif',
+              '```',
+              '',
+              'Then batch-convert all images in `static/images/`:',
+              '```bash',
+              'cd static/images',
+              'for f in *.png *.jpg *.jpeg; do',
+              '  [ -f "$f" ] && avifenc -q 80 -s 6 "$f" "${f%.*}.avif" && rm "$f"',
+              'done',
+              '```',
+            ].join('\n');
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,


This PR-commenting step will post a new comment on every workflow run as long as non-AVIF images exist (e.g., every push to the PR), which can spam the PR thread. Consider updating an existing bot comment instead (or using a sticky-comment approach) so the message is kept to a single up-to-date comment.

Copilot · 2026-03-01T20:07:14Z

+![nano met /etc/pam.d/sudo geconfigureerd voor pam_u2f.so](/images/yubikey-sudo-config.avif)
+
+Test eerst zonder de huidige terminal te sluiten:
+
+```bash


Deze markdown afbeeldingslinks verwijzen naar .avif bestanden (yubikey-sudo-config.avif, yubikey-sudo-test.avif, yubikey-polkit.avif, yubikey-gdm-password-config.avif, yubikey-lockscreen.avif), maar de afbeeldingen die in deze PR zijn toegevoegd zijn nu .png (en er bestaan geen .avif varianten in static/images/). Dit geeft gebroken afbeeldingen en/of faalt CI; converteer de afbeeldingen naar AVIF en/of pas de links aan zodat ze overeenkomen met de echte bestandsnamen.

Stensel8 added 5 commits March 1, 2026 19:24

chore: maintain docs about yubikey situation

f31bc70

Update convert-images.yml

58aa45e

docs: add more docs

26af8af

Update convert-images.yml

9be78dc

feat: improving pr checks

29a8aa6

I want to improve my PR automations. The intended goal is to notify the user if something went wrong.

Copilot AI review requested due to automatic review settings March 1, 2026 20:01

Stensel8 self-assigned this Mar 1, 2026

Stensel8 added documentation Improvements or additions to documentation github_actions Pull requests that update GitHub Actions code labels Mar 1, 2026

Copilot started reviewing on behalf of Stensel8 March 1, 2026 20:01 View session

feat: update PR checks and markdownlint configuration

d8e71ca

Copilot AI reviewed Mar 1, 2026

View reviewed changes

Stensel8 added 2 commits March 1, 2026 21:09

fix: convert images to AVIF

a3bc831

feat: enhance PR checklist with Hugo build check and cleanup

8165019

Stensel8 merged commit 6ffdc1d into main Mar 1, 2026
11 checks passed

Stensel8 deleted the development branch March 1, 2026 20:16

Navigation Menu

Uh oh!

content: maintain docs about yubikey situation - #32

content: maintain docs about yubikey situation#32
Stensel8 merged 8 commits into
mainfrom
development

Stensel8 commented Mar 1, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot commented Mar 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 1, 2026

Uh oh!

Copilot AI Mar 1, 2026

Uh oh!

Copilot AI Mar 1, 2026

Uh oh!

Copilot AI Mar 1, 2026

Uh oh!

Copilot AI Mar 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Stensel8 commented Mar 1, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of change

Checklist

Uh oh!

github-actions Bot commented Mar 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Stensel8 commented Mar 1, 2026 •

edited by github-actions Bot

Loading