From 3a408857d4554e9e5cef951eb816ab7d07888af8 Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex.wilson@digital.cabinet-office.gov.uk>
Date: Thu, 31 Mar 2022 15:52:33 +0100
Subject: [PATCH 1/9] BAU: Check for broken internal links

Sometimes we break links (full or partial) when we move pages about or rename headers, so now html-proofer will run as part of the build to make sure we've not broken any links.
---
 Gemfile   |  2 ++
 config.rb | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/Gemfile b/Gemfile
index 95a22d14..d36511e4 100644
--- a/Gemfile
+++ b/Gemfile
@@ -11,3 +11,5 @@ gem 'tzinfo-data', platforms: [:mswin, :mingw, :jruby]
 # Include the tech docs gem
 gem 'govuk_tech_docs'
 
+# Include linter to check for dead internal links
+gem 'html-proofer'
diff --git a/config.rb b/config.rb
index 4c658a71..ed181c78 100644
--- a/config.rb
+++ b/config.rb
@@ -1,5 +1,24 @@
 require 'govuk_tech_docs'
 
+# Check for broken links
+require 'html-proofer'
+
 GovukTechDocs.configure(self)
 
 set :layout, 'custom'
+
+after_build do |builder|
+  begin
+    HTMLProofer.check_directory(config[:build_dir],
+      { :assume_extension => true,
+        :disable_external => true,
+        :allow_hash_href => true,
+        :empty_alt_ignore => true,
+        :file_ignore => [
+            /search/ # Provided by tech-docs gem but has a "broken" link from html-proofer's point of view
+        ]
+      }).run
+  rescue RuntimeError => e
+    abort e.to_s
+  end
+end
\ No newline at end of file

From c8f729c72f875ff3de97656443777b8792dcca4e Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex.wilson@digital.cabinet-office.gov.uk>
Date: Thu, 31 Mar 2022 15:54:43 +0100
Subject: [PATCH 2/9] BAU: Fix currently broken internal links

- The Reliability Engineering section for CDIO no longer exists
- Remove call-to-action to update the manual as there is no corresponding section
- Re-add "Testing with RSpec" header for ruby to unbreak a link
- Update links after changes to source-code guidance structure
---
 config/tech-docs.yml                                        | 6 +++---
 .../manuals/programming-languages/nodejs/index.html.md.erb  | 3 ---
 source/manuals/programming-languages/ruby.html.md.erb       | 2 ++
 source/partials/_nav-version-control-deployments.html.erb   | 1 +
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/config/tech-docs.yml b/config/tech-docs.yml
index 0809e7a5..405e48ad 100644
--- a/config/tech-docs.yml
+++ b/config/tech-docs.yml
@@ -36,8 +36,8 @@ default_owner_slack: '#gds-way'
 owner_slack_workspace: gds
 
 redirects:
-  /standards/publish-opensource-code.html: /standards/source-code/#publish-open-source-code
-  /standards/git.html: /standards/source-code/#working-with-git
-  /standards/source-code.html: /standards/source-code/
+  /standards/publish-opensource-code.html: /standards/source-code/index.html#publish-open-source-code
+  /standards/git.html: /standards/source-code/working-with-git.html
+  /standards/cyber-security-overview.html: /standards/cdio-pillars.html#cdio-security
   /standards/testing-with-rspec.html: /manuals/programming-languages/ruby.html#testing-with-rspec
   /standards/secrets-ACL.html: /standards/secrets-acl.html
diff --git a/source/manuals/programming-languages/nodejs/index.html.md.erb b/source/manuals/programming-languages/nodejs/index.html.md.erb
index e3f3985e..9344ae5b 100644
--- a/source/manuals/programming-languages/nodejs/index.html.md.erb
+++ b/source/manuals/programming-languages/nodejs/index.html.md.erb
@@ -20,9 +20,6 @@ the main [programming languages manual page](../../programming-languages.html).
 The advice here is specifically about Node.js. Generic guidelines on writing
 code are out of scope.
 
-If you want to contribute to this document please see the [Updating this
-manual](#updating-this-manual) section below.
-
 Most guidelines listed here are recommendations, and the authors acknowledge
 that there will sometimes be valid exceptions.
 
diff --git a/source/manuals/programming-languages/ruby.html.md.erb b/source/manuals/programming-languages/ruby.html.md.erb
index 3b8c264b..8d701376 100644
--- a/source/manuals/programming-languages/ruby.html.md.erb
+++ b/source/manuals/programming-languages/ruby.html.md.erb
@@ -33,6 +33,8 @@ applications we have chosen [Sinatra] before - however this
 should be approached with caution as these can easily become large applications
 over time that are less conventionally organised than Rails applications.
 
+## Testing with RSpec
+
 For testing, the [RSpec] framework is the conventional and preferred choice.
 RSpec provides an expressive syntax that lends itself to producing readable
 tests. For testing functionality from a user's perspective it is preferred
diff --git a/source/partials/_nav-version-control-deployments.html.erb b/source/partials/_nav-version-control-deployments.html.erb
index a0faff31..5c635a90 100644
--- a/source/partials/_nav-version-control-deployments.html.erb
+++ b/source/partials/_nav-version-control-deployments.html.erb
@@ -1,5 +1,6 @@
 <ul>
   <li><a href="/standards/source-code/">How to store source code</a></li>
+  <li><a href="/standards/source-code/index.html">How to store source code</a></li>
   <li><a href="/standards/pull-requests.html">Using Pull Requests</a></li>
   <li><a href="/manuals/readme-guidance.html">Writing READMEs</a></li>
   <li><a href="/manuals/release-notes.html">Writing release notes</a></li>

From b77f928a9381233a84e01c9c271e4458d2a1faf5 Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex.wilson@digital.cabinet-office.gov.uk>
Date: Thu, 31 Mar 2022 17:07:12 +0100
Subject: [PATCH 3/9] BAU: Check for broken external links

Sometimes pages disappear from the internet or move, and we want to keep our outbound links in good condition. We sleep between requests to GitHub to avoid being rate-limited, and ignore some specific repositories which will fail the link checker.
---
 config.rb | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/config.rb b/config.rb
index ed181c78..bac1e301 100644
--- a/config.rb
+++ b/config.rb
@@ -9,15 +9,24 @@
 
 after_build do |builder|
   begin
-    HTMLProofer.check_directory(config[:build_dir],
+    proofer = HTMLProofer.check_directory(config[:build_dir],
       { :assume_extension => true,
-        :disable_external => true,
         :allow_hash_href => true,
         :empty_alt_ignore => true,
         :file_ignore => [
             /search/ # Provided by tech-docs gem but has a "broken" link from html-proofer's point of view
+        ],
+        :url_ignore => [
+            "https://github.com/alphagov/centralised-security-logging-service"
         ]
-      }).run
+      })
+
+      proofer.before_request do |request|
+        # We get rate-limited by GitHub so pause between checking GitHub links
+        sleep 2 if request.base_url == "https://github.com/"
+      end
+
+      proofer.run
   rescue RuntimeError => e
     abort e.to_s
   end

From d2453e57941eedbdbe77df28ec65f650a2e19985 Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex.wilson@digital.cabinet-office.gov.uk>
Date: Thu, 31 Mar 2022 17:09:45 +0100
Subject: [PATCH 4/9] BAU: Fix currently broken external links

- The Oracle JDK licence page does not resolve outside of a browser
- The FeatureFlags.io article is gone, replace it with a page sourced from Martin Fowler's site
- Minifycode.com is gone, replace it with a link to Google's web dev perf advice
- Replace NIST publication about least privilege with similar page from NCSC
---
 source/manuals/programming-languages/java.html.md.erb | 2 +-
 source/standards/continuous-delivery.html.md.erb      | 2 +-
 source/standards/optimise-frontend-perf.html.md.erb   | 4 ++--
 source/standards/principle-least-access.html.md.erb   | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/source/manuals/programming-languages/java.html.md.erb b/source/manuals/programming-languages/java.html.md.erb
index ab74a78a..bedc75e3 100644
--- a/source/manuals/programming-languages/java.html.md.erb
+++ b/source/manuals/programming-languages/java.html.md.erb
@@ -199,7 +199,7 @@ If you are starting a new Java project, do not use anything older than the lates
 
 If you are currently using an older LTS version of Java, you should be planning to upgrade to something newer. Different Java vendors have different support lifecycles for different Java releases.
 
-Recent versions of the [Oracle JDK can be used free of charge](https://blogs.oracle.com/java/post/free-java-license) for commercial and production purposes under the terms of a bespoke licence. OpenJDK is open source under the [GPLv2 with the Classpath Exception](https://openjdk.java.net/legal/gplv2+ce.html) but Oracle only provide general-availability [OpenJDK builds](https://jdk.java.net/) for the latest release.
+Recent versions of the [Oracle JDK can be used free of charge](https://www.oracle.com/downloads/licenses/no-fee-license.html) for commercial and production purposes under the terms of a bespoke licence. OpenJDK is open source under the [GPLv2 with the Classpath Exception](https://openjdk.java.net/legal/gplv2+ce.html) but Oracle only provide general-availability [OpenJDK builds](https://jdk.java.net/) for the latest release.
 
 The [Adoptium](https://adoptium.net/) (formerly AdoptOpenJDK) project (part of the [Eclipse Foundation](https://www.eclipse.org/)) provides fully open-source TCK-certified pre-built OpenJDK binaries under the name Eclipse Temurin. For LTS releases (such as Java 8, 11 and 17), Adoptium have committed to releasing free updates for several years.
 
diff --git a/source/standards/continuous-delivery.html.md.erb b/source/standards/continuous-delivery.html.md.erb
index b79d76b3..0df7f9b5 100644
--- a/source/standards/continuous-delivery.html.md.erb
+++ b/source/standards/continuous-delivery.html.md.erb
@@ -64,7 +64,7 @@ Find out more about continuous delivery from:
 - [Trunk Based Development][] - a source control branching method
 
 [Continuous delivery]: https://www.continuousdelivery.com
-[feature-flagging]: https://featureflags.io/2016/10/28/continuous-delivery-coding-patterns-feature-toggles/
+[feature-flagging]: https://martinfowler.com/articles/feature-toggles.html
 [modular architectures]: https://continuousdelivery.com/implementing/architecture/
 [production monitoring and alerting]: https://gds-way.cloudapps.digital/standards/monitoring.html
 [Pull Requests]: https://gds-way.cloudapps.digital/standards/pull-requests.html
diff --git a/source/standards/optimise-frontend-perf.html.md.erb b/source/standards/optimise-frontend-perf.html.md.erb
index c641c67b..993ab676 100644
--- a/source/standards/optimise-frontend-perf.html.md.erb
+++ b/source/standards/optimise-frontend-perf.html.md.erb
@@ -18,7 +18,7 @@ For example:
 |---|---|---|
 |#High|Position styles correctly|Set styles at the top of the page and `defer` scripts |
 ||Minimise HTTP requests|Minimise tiling icons, CSS and JavaScript files to reduce size and loading time [HTTP/1.1 only]|
-||Compress static resources|Use [minification][], [Gzip][], and [Brotli][] to compress CSS and JavaScript code|
+||Compress static resources|Use minification, [Gzip][], and [Brotli][] to compress CSS and JavaScript code|
 ||Set correct Headers|Set correct [Cache-Control][] and [ETag][] headers on assets for optimal caching|
 |#Medium|Look for empty image `src` attributes|Avoid using empty image `src` attributes as some browsers always send requests to them, resulting in additional traffic|
 ||Include `width` and `height` attributes on images to minimise layout thrashing | Make sure to include these attributes to improve visual stability and the [Cumulative Layout Shift (CLS)][] metric
@@ -96,7 +96,7 @@ You can find out more about improving your website’s frontend performance by r
 The Service Manual has more suggestions about [how you can test frontend performance][].
 
 [frontend performance]: https://www.gov.uk/service-manual/technology/how-to-test-frontend-performance
-[minification]: https://minifycode.com/
+[minification]: https://web.dev/reduce-network-payloads-using-text-compression/
 [Gzip]: https://web.dev/optimizing-content-efficiency-optimize-encoding-and-transfer/#text_compression_with_gzip
 [Cache-Control]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
 [ETag]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag
diff --git a/source/standards/principle-least-access.html.md.erb b/source/standards/principle-least-access.html.md.erb
index 6513d674..cc5ce4a5 100644
--- a/source/standards/principle-least-access.html.md.erb
+++ b/source/standards/principle-least-access.html.md.erb
@@ -43,6 +43,6 @@ If you’re using the gds-users account to log into your AWS accounts, you shoul
 
 - [NCSC - 10 steps to cyber security](https://www.ncsc.gov.uk/collection/10-steps)
 - [NCSC - privileged user management](https://www.ncsc.gov.uk/guidance/introduction-identity-and-access-management#section_6)
-- [NIST Special Publication 800-53 - AC-6 least privilege][polp]
+- [NCSC - preventing lateral movement][polp]
 
-[polp]: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/control?version=5.1&number=AC-6
+[polp]: https://www.ncsc.gov.uk/guidance/preventing-lateral-movement

From 0d436ed8b94ea838f4229f77eda77ca5f5d722fa Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex.wilson@digital.cabinet-office.gov.uk>
Date: Wed, 26 Apr 2023 11:21:02 +0100
Subject: [PATCH 5/9] BAU: Ignore github links

---
 Gemfile              |   2 +-
 Gemfile.lock         | 105 ++++++++++++++++++++++++++-----------------
 config.rb            |  10 ++---
 config/tech-docs.yml |   1 -
 4 files changed, 69 insertions(+), 49 deletions(-)

diff --git a/Gemfile b/Gemfile
index d36511e4..c9da2f51 100644
--- a/Gemfile
+++ b/Gemfile
@@ -12,4 +12,4 @@ gem 'tzinfo-data', platforms: [:mswin, :mingw, :jruby]
 gem 'govuk_tech_docs'
 
 # Include linter to check for dead internal links
-gem 'html-proofer'
+gem 'html-proofer', '~> 3.19.4'
diff --git a/Gemfile.lock b/Gemfile.lock
index 80b407c5..78f214b2 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,23 +1,23 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (5.2.8.1)
+    activesupport (7.0.4.3)
       concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-    addressable (2.8.1)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+    addressable (2.8.4)
       public_suffix (>= 2.0.2, < 6.0)
-    autoprefixer-rails (10.4.7.0)
+    autoprefixer-rails (10.4.13.0)
       execjs (~> 2)
-    backports (3.23.0)
+    backports (3.24.1)
     chronic (0.10.2)
     chunky_png (1.4.0)
     coffee-script (2.4.1)
       coffee-script-source
       execjs
     coffee-script-source (1.12.2)
-    commonmarker (0.23.7)
+    commonmarker (0.23.9)
     compass (1.0.3)
       chunky_png (~> 1.2)
       compass-core (~> 1.0.2)
@@ -30,19 +30,21 @@ GEM
       sass (>= 3.3.0, < 3.5)
     compass-import-once (1.0.5)
       sass (>= 3.2, < 3.5)
-    concurrent-ruby (1.2.0)
-    contracts (0.13.0)
+    concurrent-ruby (1.2.2)
+    contracts (0.16.1)
     dotenv (2.8.1)
     em-websocket (0.5.3)
       eventmachine (>= 0.12.9)
       http_parser.rb (~> 0)
     erubis (2.7.0)
+    ethon (0.16.0)
+      ffi (>= 1.15.0)
     eventmachine (1.2.7)
     execjs (2.8.1)
     fast_blank (1.0.1)
     fastimage (2.2.6)
     ffi (1.15.5)
-    govuk_tech_docs (3.3.0)
+    govuk_tech_docs (3.3.1)
       autoprefixer-rails (~> 10.2)
       chronic (~> 0.10.2)
       middleman (~> 4.0)
@@ -61,35 +63,44 @@ GEM
     hamster (3.0.0)
       concurrent-ruby (~> 1.0)
     hashie (3.6.0)
+    html-proofer (3.19.4)
+      addressable (~> 2.3)
+      mercenary (~> 0.3)
+      nokogiri (~> 1.13)
+      parallel (~> 1.10)
+      rainbow (~> 3.0)
+      typhoeus (~> 1.3)
+      yell (~> 2.0)
     http_parser.rb (0.8.0)
-    i18n (0.9.5)
+    i18n (1.6.0)
       concurrent-ruby (~> 1.0)
     kramdown (2.4.0)
       rexml
-    listen (3.0.8)
-      rb-fsevent (~> 0.9, >= 0.9.4)
-      rb-inotify (~> 0.9, >= 0.9.7)
+    listen (3.8.0)
+      rb-fsevent (~> 0.10, >= 0.10.3)
+      rb-inotify (~> 0.9, >= 0.9.10)
     memoist (0.16.2)
-    middleman (4.3.11)
+    mercenary (0.4.0)
+    middleman (4.4.3)
       coffee-script (~> 2.2)
-      haml (>= 4.0.5)
+      haml (>= 4.0.5, < 6.0)
       kramdown (>= 2.3.0)
-      middleman-cli (= 4.3.11)
-      middleman-core (= 4.3.11)
+      middleman-cli (= 4.4.3)
+      middleman-core (= 4.4.3)
     middleman-autoprefixer (2.10.0)
       autoprefixer-rails (>= 9.1.4)
       middleman-core (>= 3.3.3)
-    middleman-cli (4.3.11)
+    middleman-cli (4.4.3)
       thor (>= 0.17.0, < 2.0)
     middleman-compass (4.0.1)
       compass (>= 1.0.0, < 2.0.0)
       middleman-core (>= 4.0.0)
-    middleman-core (4.3.11)
-      activesupport (>= 4.2, < 6.0)
-      addressable (~> 2.3)
+    middleman-core (4.4.3)
+      activesupport (>= 6.1, < 7.1)
+      addressable (~> 2.4)
       backports (~> 3.6)
-      bundler
-      contracts (~> 0.13.0)
+      bundler (~> 2.0)
+      contracts (~> 0.13)
       dotenv
       erubis
       execjs (~> 2.0)
@@ -97,21 +108,23 @@ GEM
       fastimage (~> 2.0)
       hamster (~> 3.0)
       hashie (~> 3.4)
-      i18n (~> 0.9.0)
-      listen (~> 3.0.0)
+      i18n (~> 1.6.0)
+      listen (~> 3.0)
       memoist (~> 0.14)
-      padrino-helpers (~> 0.13.0)
+      padrino-helpers (~> 0.15.0)
       parallel
       rack (>= 1.4.5, < 3)
       sassc (~> 2.0)
       servolux
       tilt (~> 2.0.9)
+      toml
       uglifier (~> 3.0)
+      webrick
     middleman-livereload (3.4.7)
       em-websocket (~> 0.5.1)
       middleman-core (>= 3.3)
       rack-livereload (~> 0.3.15)
-    middleman-search-gds (0.11.1)
+    middleman-search-gds (0.11.2)
       execjs (~> 2.6)
       middleman-core (>= 3.2)
       nokogiri (~> 1.6)
@@ -122,25 +135,26 @@ GEM
       middleman-core (>= 3.2)
       rouge (~> 3.2)
     mini_portile2 (2.8.1)
-    minitest (5.17.0)
+    minitest (5.18.0)
     multi_json (1.15.0)
-    nokogiri (1.14.0)
+    nokogiri (1.14.3)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     openapi3_parser (0.9.2)
       commonmarker (~> 0.17)
-    padrino-helpers (0.13.3.4)
-      i18n (~> 0.6, >= 0.6.7)
-      padrino-support (= 0.13.3.4)
+    padrino-helpers (0.15.3)
+      i18n (>= 0.6.7, < 2)
+      padrino-support (= 0.15.3)
       tilt (>= 1.4.1, < 3)
-    padrino-support (0.13.3.4)
-      activesupport (>= 3.1)
-    parallel (1.22.1)
+    padrino-support (0.15.3)
+    parallel (1.23.0)
+    parslet (2.0.0)
     public_suffix (5.0.1)
     racc (1.6.2)
-    rack (2.2.6.4)
+    rack (2.2.7)
     rack-livereload (0.3.17)
       rack
+    rainbow (3.1.1)
     rb-fsevent (0.11.2)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
@@ -156,17 +170,26 @@ GEM
       rack (>= 2.2.4, < 4)
     temple (0.10.0)
     thor (1.2.1)
-    thread_safe (0.3.6)
     tilt (2.0.11)
-    tzinfo (1.2.10)
-      thread_safe (~> 0.1)
+    toml (0.3.0)
+      parslet (>= 1.8.0, < 3.0.0)
+    typhoeus (1.4.0)
+      ethon (>= 0.9.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
     uglifier (3.2.0)
       execjs (>= 0.3.0, < 3)
+    webrick (1.8.1)
+    yell (2.2.2)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   govuk_tech_docs
+  html-proofer (~> 3.19.4)
   tzinfo-data
   wdm (~> 0.1.0)
+
+BUNDLED WITH
+   2.1.4
diff --git a/config.rb b/config.rb
index bac1e301..d8a30eb3 100644
--- a/config.rb
+++ b/config.rb
@@ -17,15 +17,13 @@
             /search/ # Provided by tech-docs gem but has a "broken" link from html-proofer's point of view
         ],
         :url_ignore => [
-            "https://github.com/alphagov/centralised-security-logging-service"
+            "https://github.com/alphagov/centralised-security-logging-service",
+            "https://gdshelpdesk.digital.cabinet-office.gov.uk",
+            "https://gds-way.cloudapps.digital/standards/secrets-acl.html",
+            /https:\/\/github.com\//
         ]
       })
 
-      proofer.before_request do |request|
-        # We get rate-limited by GitHub so pause between checking GitHub links
-        sleep 2 if request.base_url == "https://github.com/"
-      end
-
       proofer.run
   rescue RuntimeError => e
     abort e.to_s
diff --git a/config/tech-docs.yml b/config/tech-docs.yml
index 405e48ad..ff5993fd 100644
--- a/config/tech-docs.yml
+++ b/config/tech-docs.yml
@@ -38,6 +38,5 @@ owner_slack_workspace: gds
 redirects:
   /standards/publish-opensource-code.html: /standards/source-code/index.html#publish-open-source-code
   /standards/git.html: /standards/source-code/working-with-git.html
-  /standards/cyber-security-overview.html: /standards/cdio-pillars.html#cdio-security
   /standards/testing-with-rspec.html: /manuals/programming-languages/ruby.html#testing-with-rspec
   /standards/secrets-ACL.html: /standards/secrets-acl.html

From c63c2283bea324f82fdd36c1e571a1fc09cfd019 Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex.wilson@digital.cabinet-office.gov.uk>
Date: Thu, 27 Apr 2023 11:56:56 +0100
Subject: [PATCH 6/9] BAU: Pull-request feedback

---
 source/partials/_nav-version-control-deployments.html.erb | 1 -
 source/standards/optimise-frontend-perf.html.md.erb       | 2 +-
 source/standards/principle-least-access.html.md.erb       | 4 ++--
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/source/partials/_nav-version-control-deployments.html.erb b/source/partials/_nav-version-control-deployments.html.erb
index 5c635a90..91313e89 100644
--- a/source/partials/_nav-version-control-deployments.html.erb
+++ b/source/partials/_nav-version-control-deployments.html.erb
@@ -1,5 +1,4 @@
 <ul>
-  <li><a href="/standards/source-code/">How to store source code</a></li>
   <li><a href="/standards/source-code/index.html">How to store source code</a></li>
   <li><a href="/standards/pull-requests.html">Using Pull Requests</a></li>
   <li><a href="/manuals/readme-guidance.html">Writing READMEs</a></li>
diff --git a/source/standards/optimise-frontend-perf.html.md.erb b/source/standards/optimise-frontend-perf.html.md.erb
index 993ab676..772a2d47 100644
--- a/source/standards/optimise-frontend-perf.html.md.erb
+++ b/source/standards/optimise-frontend-perf.html.md.erb
@@ -18,7 +18,7 @@ For example:
 |---|---|---|
 |#High|Position styles correctly|Set styles at the top of the page and `defer` scripts |
 ||Minimise HTTP requests|Minimise tiling icons, CSS and JavaScript files to reduce size and loading time [HTTP/1.1 only]|
-||Compress static resources|Use minification, [Gzip][], and [Brotli][] to compress CSS and JavaScript code|
+||Compress static resources|Use [minification][], [Gzip][], and [Brotli][] to compress CSS and JavaScript code|
 ||Set correct Headers|Set correct [Cache-Control][] and [ETag][] headers on assets for optimal caching|
 |#Medium|Look for empty image `src` attributes|Avoid using empty image `src` attributes as some browsers always send requests to them, resulting in additional traffic|
 ||Include `width` and `height` attributes on images to minimise layout thrashing | Make sure to include these attributes to improve visual stability and the [Cumulative Layout Shift (CLS)][] metric
diff --git a/source/standards/principle-least-access.html.md.erb b/source/standards/principle-least-access.html.md.erb
index cc5ce4a5..cda6fa39 100644
--- a/source/standards/principle-least-access.html.md.erb
+++ b/source/standards/principle-least-access.html.md.erb
@@ -43,6 +43,6 @@ If you’re using the gds-users account to log into your AWS accounts, you shoul
 
 - [NCSC - 10 steps to cyber security](https://www.ncsc.gov.uk/collection/10-steps)
 - [NCSC - privileged user management](https://www.ncsc.gov.uk/guidance/introduction-identity-and-access-management#section_6)
-- [NCSC - preventing lateral movement][polp]
+- [NIST Special Publication 800-53 - AC-6 least privilege][polp]
 
-[polp]: https://www.ncsc.gov.uk/guidance/preventing-lateral-movement
+[polp]: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search

From da9b579773ff804dfb321792c5e8a17c5ece0ec1 Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex.wilson@digital.cabinet-office.gov.uk>
Date: Thu, 27 Apr 2023 12:27:50 +0100
Subject: [PATCH 7/9] BAU: Minimise Gemfile.lock changes

---
 Gemfile.lock | 81 ++++++++++++++++++++++++----------------------------
 1 file changed, 38 insertions(+), 43 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 78f214b2..c6828896 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,23 +1,23 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.0.4.3)
+    activesupport (5.2.8.1)
       concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 1.6, < 2)
-      minitest (>= 5.1)
-      tzinfo (~> 2.0)
-    addressable (2.8.4)
+      i18n (>= 0.7, < 2)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    addressable (2.8.1)
       public_suffix (>= 2.0.2, < 6.0)
-    autoprefixer-rails (10.4.13.0)
+    autoprefixer-rails (10.4.7.0)
       execjs (~> 2)
-    backports (3.24.1)
+    backports (3.23.0)
     chronic (0.10.2)
     chunky_png (1.4.0)
     coffee-script (2.4.1)
       coffee-script-source
       execjs
     coffee-script-source (1.12.2)
-    commonmarker (0.23.9)
+    commonmarker (0.23.7)
     compass (1.0.3)
       chunky_png (~> 1.2)
       compass-core (~> 1.0.2)
@@ -30,8 +30,8 @@ GEM
       sass (>= 3.3.0, < 3.5)
     compass-import-once (1.0.5)
       sass (>= 3.2, < 3.5)
-    concurrent-ruby (1.2.2)
-    contracts (0.16.1)
+    concurrent-ruby (1.2.0)
+    contracts (0.13.0)
     dotenv (2.8.1)
     em-websocket (0.5.3)
       eventmachine (>= 0.12.9)
@@ -44,7 +44,7 @@ GEM
     fast_blank (1.0.1)
     fastimage (2.2.6)
     ffi (1.15.5)
-    govuk_tech_docs (3.3.1)
+    govuk_tech_docs (3.3.0)
       autoprefixer-rails (~> 10.2)
       chronic (~> 0.10.2)
       middleman (~> 4.0)
@@ -72,35 +72,35 @@ GEM
       typhoeus (~> 1.3)
       yell (~> 2.0)
     http_parser.rb (0.8.0)
-    i18n (1.6.0)
+    i18n (0.9.5)
       concurrent-ruby (~> 1.0)
     kramdown (2.4.0)
       rexml
-    listen (3.8.0)
-      rb-fsevent (~> 0.10, >= 0.10.3)
-      rb-inotify (~> 0.9, >= 0.9.10)
+    listen (3.0.8)
+      rb-fsevent (~> 0.9, >= 0.9.4)
+      rb-inotify (~> 0.9, >= 0.9.7)
     memoist (0.16.2)
     mercenary (0.4.0)
-    middleman (4.4.3)
+    middleman (4.3.11)
       coffee-script (~> 2.2)
-      haml (>= 4.0.5, < 6.0)
+      haml (>= 4.0.5)
       kramdown (>= 2.3.0)
-      middleman-cli (= 4.4.3)
-      middleman-core (= 4.4.3)
+      middleman-cli (= 4.3.11)
+      middleman-core (= 4.3.11)
     middleman-autoprefixer (2.10.0)
       autoprefixer-rails (>= 9.1.4)
       middleman-core (>= 3.3.3)
-    middleman-cli (4.4.3)
+    middleman-cli (4.3.11)
       thor (>= 0.17.0, < 2.0)
     middleman-compass (4.0.1)
       compass (>= 1.0.0, < 2.0.0)
       middleman-core (>= 4.0.0)
-    middleman-core (4.4.3)
-      activesupport (>= 6.1, < 7.1)
-      addressable (~> 2.4)
+    middleman-core (4.3.11)
+      activesupport (>= 4.2, < 6.0)
+      addressable (~> 2.3)
       backports (~> 3.6)
-      bundler (~> 2.0)
-      contracts (~> 0.13)
+      bundler
+      contracts (~> 0.13.0)
       dotenv
       erubis
       execjs (~> 2.0)
@@ -108,23 +108,21 @@ GEM
       fastimage (~> 2.0)
       hamster (~> 3.0)
       hashie (~> 3.4)
-      i18n (~> 1.6.0)
-      listen (~> 3.0)
+      i18n (~> 0.9.0)
+      listen (~> 3.0.0)
       memoist (~> 0.14)
-      padrino-helpers (~> 0.15.0)
+      padrino-helpers (~> 0.13.0)
       parallel
       rack (>= 1.4.5, < 3)
       sassc (~> 2.0)
       servolux
       tilt (~> 2.0.9)
-      toml
       uglifier (~> 3.0)
-      webrick
     middleman-livereload (3.4.7)
       em-websocket (~> 0.5.1)
       middleman-core (>= 3.3)
       rack-livereload (~> 0.3.15)
-    middleman-search-gds (0.11.2)
+    middleman-search-gds (0.11.1)
       execjs (~> 2.6)
       middleman-core (>= 3.2)
       nokogiri (~> 1.6)
@@ -135,23 +133,23 @@ GEM
       middleman-core (>= 3.2)
       rouge (~> 3.2)
     mini_portile2 (2.8.1)
-    minitest (5.18.0)
+    minitest (5.17.0)
     multi_json (1.15.0)
-    nokogiri (1.14.3)
+    nokogiri (1.14.0)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     openapi3_parser (0.9.2)
       commonmarker (~> 0.17)
-    padrino-helpers (0.15.3)
-      i18n (>= 0.6.7, < 2)
-      padrino-support (= 0.15.3)
+    padrino-helpers (0.13.3.4)
+      i18n (~> 0.6, >= 0.6.7)
+      padrino-support (= 0.13.3.4)
       tilt (>= 1.4.1, < 3)
-    padrino-support (0.15.3)
-    parallel (1.23.0)
-    parslet (2.0.0)
+    padrino-support (0.13.3.4)
+      activesupport (>= 3.1)
+    parallel (1.22.1)
     public_suffix (5.0.1)
     racc (1.6.2)
-    rack (2.2.7)
+    rack (2.2.6.4)
     rack-livereload (0.3.17)
       rack
     rainbow (3.1.1)
@@ -171,15 +169,12 @@ GEM
     temple (0.10.0)
     thor (1.2.1)
     tilt (2.0.11)
-    toml (0.3.0)
-      parslet (>= 1.8.0, < 3.0.0)
     typhoeus (1.4.0)
       ethon (>= 0.9.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     uglifier (3.2.0)
       execjs (>= 0.3.0, < 3)
-    webrick (1.8.1)
     yell (2.2.2)
 
 PLATFORMS

From 9e2219efb6d30f02142bf908b288fff2c0c8bcbc Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex.wilson@digital.cabinet-office.gov.uk>
Date: Wed, 17 May 2023 09:54:40 +0100
Subject: [PATCH 8/9] BAU: Check internal hashes

Also remove duplication between a single GitHub URL and the blanket GitHub regex
---
 config.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config.rb b/config.rb
index d8a30eb3..46bb32b6 100644
--- a/config.rb
+++ b/config.rb
@@ -12,12 +12,12 @@
     proofer = HTMLProofer.check_directory(config[:build_dir],
       { :assume_extension => true,
         :allow_hash_href => true,
+        :check_internal_hash => true,
         :empty_alt_ignore => true,
         :file_ignore => [
             /search/ # Provided by tech-docs gem but has a "broken" link from html-proofer's point of view
         ],
         :url_ignore => [
-            "https://github.com/alphagov/centralised-security-logging-service",
             "https://gdshelpdesk.digital.cabinet-office.gov.uk",
             "https://gds-way.cloudapps.digital/standards/secrets-acl.html",
             /https:\/\/github.com\//

From d5c58f2aa6f8dc2a2ec7a637a4d68a5746f06745 Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex.wilson@digital.cabinet-office.gov.uk>
Date: Wed, 17 May 2023 10:15:32 +0100
Subject: [PATCH 9/9] BAU: Update Paul's page to mastodon rather than twitter

---
 source/standards/pull-requests.html.md.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source/standards/pull-requests.html.md.erb b/source/standards/pull-requests.html.md.erb
index 69ac2116..0d2ed790 100644
--- a/source/standards/pull-requests.html.md.erb
+++ b/source/standards/pull-requests.html.md.erb
@@ -144,5 +144,5 @@ You should add a documentation credit thanking the contributor if you do not add
 [good-pr]: https://github.com/alphagov/frontend/pull/784
 [alice]: https://github.com/alicebartlett
 [style-enf]: https://technology.blog.gov.uk/2016/09/30/easing-the-process-of-pull-request-reviews/
-[paul]: https://twitter.com/boffbowsh
+[paul]: https://mastodon.me.uk/@boffbowsh
 [prs]: https://docs.github.com/en/github/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-pull-requests