Add hydrate-localize composite GitHub Action

[Copilot]

Adds a reusable GitHub composite action to crawl a target docs environment with headless Chromium, triggering Localize phrase detection. Intended to be pointed at a lower environment (QA/UAT/preprod) to prevent local browser extension artifacts (e.g., translation plugins) from polluting Localize's phrase corpus on production.

Action inputs

• target_base_url (required): base URL of the environment to crawl
• sitemap_path (optional, default: sitemap.xml): sitemap path relative to base URL
• skip_path_prefixes (optional, default: api-catalog): comma-separated list of URL path prefixes for which Localize is disabled and the crawler should not wait for a Localize request

Example usage

- uses: equinix-labs/docusaurus-plugin-localizejs/.github/actions/hydrate-localize@main
  with:
    target_base_url: https://docs-staging.equinix.com
    sitemap_path: sitemap.xml          # optional
    skip_path_prefixes: api-catalog,reference  # optional

Key implementation notes

• Fixes duplicate requestHandler bug from the original prototype — the second definition silently overwrote the first, dropping the page.waitForRequest logic entirely
• URL rewriting uses pathname + search + hash from the sitemap URL rather than a hardcoded https://docs.equinix.com string replace, making the action origin-agnostic
• Localize CDN origin check uses new URL(req.url()).origin === instead of startsWith() to prevent subdomain bypass (CodeQL js/incomplete-url-substring-sanitization)
• Skip path prefixes are parsed from a comma-separated input, with leading slashes stripped to avoid double-slash matches, and checked via pathname.startsWith(/${prefix}) — supporting multiple path subtrees where Localize is inactive
• playwright pinned to ^1.55.1 (patched SSL certificate verification vulnerability present in <1.55.1)
• "type": "module" set in package.json for ESM import syntax; package-lock.json committed for reproducible npm ci

Known limitation

crawlee's transitive dependency on minimatch <10.2.1 (GHSA-3ppc-4f35-3m26, ReDoS) has no fix available in the current crawlee release line.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[displague]

@copilot api-catalog would be a variable that takes multiple path prefixes to apply this logic to

[Copilot]

Done in feb4090. Added a skip_path_prefixes input (comma-separated, defaults to api-catalog) to action.yml. In index.js it's parsed into an array and checked with pathname.startsWith(/${prefix}) — leading slashes in user-supplied prefixes are stripped to avoid double-slash matches.