feat: update to website v5.0.0

.dockerignore

@@ -1,6 +1,12 @@
 Dockerfile
+.git/
 
-__pycache__/
+**/__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/
 .vscode/
 
 content/
@@ -10,4 +16,5 @@ attack-releases/
 
 venv/
 .venv/
+**/node_modules/
 .env

.env.template

@@ -1,17 +1,51 @@
+# Local configuration for update-attack.py.
+#
+# Copy this file to .env, then change only the values needed for the local build:
+#   cp .env.template .env
+#
+# Shell environment variables override .env values. Do not commit .env, especially
+# when it contains ATTACK_WEBSITE_WORKBENCH_API_KEY. Docker build arguments are
+# configured separately; see docs/DOCKER.md.
+
+# Pelican metadata. These variables are passed directly to Pelican and intentionally
+# do not use the ATTACK_WEBSITE_ prefix. Defaults: MITRE, ATT&CK, empty site URL,
+# America/New_York, and en.
 PELICAN_AUTHOR="MITRE"
 PELICAN_SITENAME="ATT&CK"
-PELICAN_SITEURL="https://attack.mitre.org"
+PELICAN_SITEURL=""
 PELICAN_TIMEZONE="America/New_York"
 PELICAN_DEFAULT_LANG="en"
-ATTACK_VERSION_ARCHIVES="attack-version-archives"
-BANNER_ENABLED=True
-BANNER_MESSAGE="This is a custom instance of the MITRE ATT&CK Website. The official website can be found at <a href='https://attack.mitre.org'>attack.mitre.org</a>."
-STIX_LOCATION_ENTERPRISE="https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json"
-STIX_LOCATION_MOBILE="https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json"
-STIX_LOCATION_ICS="https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json"
-STIX_LOCATION_PRE="https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json"
-WORKBENCH_USER=""
-WORKBENCH_API_KEY=""
-GOOGLE_ANALYTICS=""
-GOOGLE_SITE_VERIFICATION=""
-INCLUDE_OSANO=""
+
+# Branding, banner, and optional build behavior. Boolean values accept true/false,
+# yes/no, on/off, 1/0, and similar Typer forms. Defaults: custom-instance branding,
+# banner enabled with the message below, failed tests return a nonzero status,
+# and optional extras are not run.
+# When ATTACK_WEBSITE_ATTACK_BRAND=true is set without an explicit banner setting,
+# the stock custom-instance banner remains hidden; this template explicitly enables it.
+ATTACK_WEBSITE_ATTACK_BRAND=false
+ATTACK_WEBSITE_BANNER_ENABLED=true
+ATTACK_WEBSITE_BANNER_MESSAGE="This is a custom instance of the MITRE ATT&CK Website. The official website can be found at <a href='https://attack.mitre.org'>attack.mitre.org</a>."
+ATTACK_WEBSITE_TEST_EXITSTATUS=true
+ATTACK_WEBSITE_UPDATE_ATTACK_ALL_EXTRAS=false
+
+# STIX sources and version archives. Each STIX value can be an HTTP(S) URL or a
+# local JSON path. These values are the built-in defaults; archived versions use
+# attack-version-archives relative to the repository by default.
+ATTACK_WEBSITE_STIX_LOCATION_ENTERPRISE="https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json"
+ATTACK_WEBSITE_STIX_LOCATION_MOBILE="https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json"
+ATTACK_WEBSITE_STIX_LOCATION_ICS="https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json"
+ATTACK_WEBSITE_STIX_LOCATION_PRE="https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json"
+ATTACK_WEBSITE_ATTACK_VERSION_ARCHIVES="attack-version-archives"
+
+# Optional Workbench credentials for authenticated STIX downloads. Leave both
+# values empty by default; the API key is used only when a user is also supplied.
+#ATTACK_WEBSITE_WORKBENCH_USER=""
+#ATTACK_WEBSITE_WORKBENCH_API_KEY=""
+
+# Optional page integrations. Both values are empty by default. The command-line
+# --google-analytics and --google-site-verification options take precedence.
+#ATTACK_WEBSITE_GOOGLE_ANALYTICS=""
+#ATTACK_WEBSITE_GOOGLE_SITE_VERIFICATION=""
+
+# Optional Osano privacy-compliance script. Disabled by default.
+#ATTACK_WEBSITE_INCLUDE_OSANO=false

.github/workflows/gh-pages.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup Node.js environment
         uses: actions/setup-node@v4
         with:
-          node-version: '18.x'
+          node-version: '26.x'
 
       - name: Upgrade pip
         run: python3 -m pip install --upgrade pip
@@ -32,22 +32,25 @@ jobs:
         run: python3 -m pip install -r requirements.txt
 
       - name: Get banner message
-        run: echo "BANNER_MESSAGE=$(<website-banner.production)" >> $GITHUB_ENV
+        run: echo "ATTACK_WEBSITE_BANNER_MESSAGE=$(<website-banner.production)" >> $GITHUB_ENV
 
       - name: Toggle banner if there is a message
         run: |
-          if [[ -z "${BANNER_MESSAGE}" ]]; then
-            echo "BANNER_ENABLED=False" >> $GITHUB_ENV
+          if [[ -z "${ATTACK_WEBSITE_BANNER_MESSAGE}" ]]; then
+            echo "ATTACK_WEBSITE_BANNER_ENABLED=false" >> $GITHUB_ENV
           else
-            echo "BANNER_ENABLED=True" >> $GITHUB_ENV
+            echo "ATTACK_WEBSITE_BANNER_ENABLED=true" >> $GITHUB_ENV
           fi
 
       - name: Build website
-        run: python3 update-attack.py --attack-brand --extras --no-test-exitstatus
+        run: >-
+          python3 update-attack.py --attack-brand
+          --all-extras
+          --no-test-exitstatus
         env:
-          GOOGLE_ANALYTICS: ${{ secrets.GOOGLE_ANALYTICS }}
-          GOOGLE_SITE_VERIFICATION: ${{ secrets.GOOGLE_SITE_VERIFICATION }}
-          INCLUDE_OSANO: true
+          ATTACK_WEBSITE_GOOGLE_ANALYTICS: ${{ secrets.GOOGLE_ANALYTICS }}
+          ATTACK_WEBSITE_GOOGLE_SITE_VERIFICATION: ${{ secrets.GOOGLE_SITE_VERIFICATION }}
+          ATTACK_WEBSITE_INCLUDE_OSANO: true
           PELICAN_SITEURL: https://attack.mitre.org
 
       - name: Cleanup build

AGENTS.md

@@ -8,7 +8,7 @@ This file is guidance for coding agents working in `attack-website`.
 - There was no existing `AGENTS.md` to preserve.
 - No Cursor rules were found in `.cursor/rules/` or `.cursorrules`.
 - No Copilot instructions were found in `.github/copilot-instructions.md`.
-- Primary human docs are `DEVELOPMENT.md`, `README.md`, `test/README.md`, and `CONTRIBUTING.md`.
+- Primary human docs are `docs/DEVELOPMENT.md`, `README.md`, `test/README.md`, and `docs/CONTRIBUTING.md`.
 
 ## Repo Shape
 
@@ -30,7 +30,7 @@ This file is guidance for coding agents working in `attack-website`.
 - Docker is the preferred way to validate the final static output in an Nginx-like environment.
 - CI currently uses Python `3.13` and Node `18.x` in `.github/workflows/gh-pages.yml`.
 - Prefer CI versions when reproducing CI behavior; Docker and development docs may reference older base images.
-- Production-like builds may depend on environment variables from `.github/workflows/gh-pages.yml`, including `GOOGLE_ANALYTICS`, `GOOGLE_SITE_VERIFICATION`, `INCLUDE_OSANO`, and `PELICAN_SITEURL`.
+- Production-like builds may depend on environment variables from `.github/workflows/gh-pages.yml`, including `ATTACK_WEBSITE_GOOGLE_ANALYTICS`, `ATTACK_WEBSITE_GOOGLE_SITE_VERIFICATION`, `ATTACK_WEBSITE_INCLUDE_OSANO`, and `PELICAN_SITEURL`.
 
 ## High-Value Commands
 
@@ -46,7 +46,7 @@ Run commands from the repo root unless a subdirectory is called out.
 
 ### Build
 
-- Main website build: `uv run python update-attack.py --attack-brand --extras --no-test-exitstatus`
+- Main website build: `uv run python update-attack.py --attack-brand --all-extras --no-test-exitstatus`
 - Search bundle: `cd attack-search && npm run build`
 - Search dev bundle: `cd attack-search && npm run build:dev`
 - Copy built search bundle into site output: `cd attack-search && npm run copy`
@@ -55,7 +55,7 @@ Run commands from the repo root unless a subdirectory is called out.
 
 ### Local Validation
 
-- Full local site validation follows `DEVELOPMENT.md` and `test/README.md`.
+- Full local site validation follows `docs/DEVELOPMENT.md` and `test/README.md`.
 - Build site output first, then serve `output/` through the Docker test image.
 - Test container build: `cd test && docker build -t attack-website-test .`
 - Test container run: `cd test && docker run -p 80:80 -v $(pwd)/../output:/workspace attack-website-test`
@@ -77,7 +77,7 @@ Run commands from the repo root unless a subdirectory is called out.
 - Alternate single Jest file: `cd attack-search && npx jest __tests__/search-service.test.js`
 - Main Python-driven site tests run through the build script, not `pytest`.
 - Run specific site test categories: `uv run python update-attack.py -m tests -t size`
-- Multiple site test categories: `uv run python update-attack.py -m tests -t links external_links citations`
+- Multiple site test categories: `uv run python update-attack.py -m tests -t links -t external_links -t citations`
 
 ### Important Command Notes
 
@@ -91,7 +91,7 @@ Run commands from the repo root unless a subdirectory is called out.
 
 - Follow existing file-local conventions before applying generic preferences.
 - Treat `pyproject.toml`, `attack-search/.eslintrc`, and `attack-style/.stylelintrc.json` as authoritative style configs.
-- Treat `DEVELOPMENT.md` and `.github/workflows/gh-pages.yml` as authoritative for build workflow.
+- Treat `docs/DEVELOPMENT.md` and `.github/workflows/gh-pages.yml` as authoritative for build workflow.
 - In templates, respect comments that mark generated files or source-of-truth files.
 - Example: `attack-theme/templates/general/base-template.html` explicitly says to edit `base-template.html`, not generated `base.html`.
 
@@ -186,7 +186,7 @@ Run commands from the repo root unless a subdirectory is called out.
 
 ## Git And Contribution Notes
 
-- Pull requests should target the `develop` branch per `CONTRIBUTING.md`.
+- Pull requests should target the `develop` branch per `docs/CONTRIBUTING.md`.
 - The PR template expects a reviewer and a `CHANGELOG.md` update when appropriate.
 - The website version is configured in `modules/site_config.py`; keep it aligned with release tags and docs.
 - Do not assume `master` is the integration branch just because GitHub Pages deploys from it.

CHANGELOG.md

@@ -1,12 +1,34 @@
 # Website Changelog
 
+## v5.0.0 (2026-08-06)
+
+* Release ATT&CK content version 19.2.
+  See detailed changes [here](https://github.com/mitre/cti/releases/tag/ATT%26CK-v19.2).
+
+### Breaking Changes
+
+* Migrate the `update-attack.py` command-line interface from argparse to Typer.
+* Require `--modules`, `--extras`, and `--test` to be repeated for each selected value.
+* Replace the value-less `--extras` behavior with the explicit `--all-extras` flag.
+
+  | Before v5.0.0 | v5.0.0 and later |
+  | --- | --- |
+  | `-m clean techniques website_build` | `-m clean -m techniques -m website_build` |
+  | `-t size links citations` | `-t size -t links -t citations` |
+  | `-e resources blog` | `-e resources -e blog` |
+  | `--extras` | `--all-extras` |
+
+### Upgrade notes
+
+* Project-owned build environment variables now use the `ATTACK_WEBSITE_` prefix, including `ATTACK_WEBSITE_ATTACK_BRAND`, `ATTACK_WEBSITE_BANNER_ENABLED`, `ATTACK_WEBSITE_INCLUDE_OSANO`, `ATTACK_WEBSITE_TEST_EXITSTATUS`, and `ATTACK_WEBSITE_UPDATE_ATTACK_ALL_EXTRAS`. Legacy unprefixed names are no longer accepted; `PELICAN_*` variables remain unchanged because Pelican consumes them directly.
+
 ## v4.4.3 (2026-05-12)
 
 ### Features
 
 * Release ATT&CK content version 19.1.
   See detailed changes [here](https://github.com/mitre/cti/releases/tag/ATT%26CK-v19.1).
-  
+
 ## v4.4.2 (2026-04-28)
 
 ### Features