feat: update to website v5.0.0

[jondricek]

Breaking changes!

But good ones!

Two major things here. First, we're updating update-attack.py to use typer instead of argparse, so we've added that dependency to the requirements.txt. This helps a ton with environment variable handling, and this script and repo is custom enough as it is, so any amount of modernization is good, albeit a breaking change in that a new dependency is being added and the flags to the script are changing. This has the added benefit that the Dockerfile and .env.template have been updated to use these as well.

Secondly we're releasing ATT&CK v19.2 with this pull request at the same time.

[Copilot]

Pull request overview

This PR bumps the website to v5.0.0, pairing the ATT&CK v19.2 content release with a modernization of the build tooling by migrating update-attack.py from argparse to Typer, and aligning Docker/CI/docs around the new CLI and ATTACK_WEBSITE_ environment variable scheme.

Changes:

• Migrate update-attack.py CLI to Typer; introduce explicit --all-extras and repeatable --modules/--extras/--test options, plus envvar-backed build toggles.
• Standardize project-owned environment variables to the ATTACK_WEBSITE_ prefix across configuration, CI, Docker, and documentation.
• Release ATT&CK v19.2 (versions metadata + new “Updates - July 2026” page) and refresh banner content.

Reviewed changes

Copilot reviewed 20 out of 22 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
website-banner.production	Updates the production banner message and links for ATT&CKcon 7.0.
update-attack.py	Replaces argparse with Typer and reworks option/envvar handling for the website build entrypoint.
test/README.md	Updates build invocation to the new --all-extras flag style.
requirements.txt	Updates dependency pins and adds typer.
README.md	Fixes/expands documentation links under Development.
modules/website_build/website_build.py	Adjusts banner and Osano settings behavior to use new CLI/envvar plumbing.
modules/stixtests/linkbyidchecker.py	Expands STIX object types checked for ATT&CK IDs to include Campaigns.
modules/site_config.py	Bumps website version to 5.0.0 and migrates config envvars to the ATTACK_WEBSITE_ prefix.
modules/resources/static_pages/updates-july-2026.md	Adds the ATT&CK v19.2 release update page.
modules/resources/static_pages/updates-april-2026.md	Links forward to the new July 2026 updates page.
docs/RELEASE.md	Updates release instructions/examples for the new CLI.
docs/DOCKER.md	Adds a dedicated Docker build guide documenting build args, secrets, and new CLI/envvar behavior.
docs/DEVELOPMENT.md	Updates developer workflow docs for the new Docker process, versions, and CLI examples.
docs/CUSTOMIZING.md	Documents the new ATTACK_WEBSITE_ envvar scheme and revised CLI semantics.
docs/CONTRIBUTING.md	Adds a contribution guide with DCO text and target-branch guidance.
Dockerfile	Modernizes the multi-stage build (Node 26 / Python 3.13), adds build args/secrets/caching, and wires new envvars/CLI usage.
data/versions.json	Updates “current” ATT&CK version metadata to v19.2 and points to the new changelog page.
CHANGELOG.md	Adds v5.0.0 release notes and documents breaking CLI/envvar changes.
AGENTS.md	Updates agent guidance and command examples to match v5.0.0 CLI/docs layout.
.github/workflows/gh-pages.yml	Updates CI to Node 26 and switches to ATTACK_WEBSITE_ envvars + new build invocation.
.env.template	Rewrites the template around ATTACK_WEBSITE_ variables and updated defaults/notes.
.dockerignore	Expands ignore patterns to reduce build context size and avoid sending caches/deps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 64 changed files in this pull request and generated no new comments.

Suppressed comments (1)

update-attack.py:82

• cli() is registered as a subcommand via @app.command(...), but main() calls app() directly and the repo/docs/CI invoke python update-attack.py --flags without a subcommand. With the current Typer setup, that invocation will fail (options like --attack-brand aren’t defined at the app root) or require python update-attack.py cli ..., which is an undocumented breaking change. Register this function as the root callback (or switch to typer.run(cli)) so existing invocations continue to work.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 64 changed files in this pull request and generated no new comments.

Suppressed comments (2)

data/versions.json:4

• data/versions.json marks v19.2 as the current version, but date_start is still April 28, 2026 (the v19.0 date). The versions page template renders version_history.current.date_start for the current version, so this will display an incorrect “live since” date for v19.2.

        "date_start": "April 28, 2026",

modules/resources/static_pages/updates-april-2026.md:13

• This “subsequent ATT&CK v19.2 release notes” link points to /resources/updates/updates-july-2026/, but the v19.2 update page is generated at /resources/updates/updates-august-2026/ (see url: in the v19.2 update post and data/versions.json). This will produce a broken link from the April 2026 release notes.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 64 changed files in this pull request and generated no new comments.

Suppressed comments (1)

update-attack.py:84

• Using @app.command() makes this script behave like a multi-command Typer app, which requires an explicit subcommand name (e.g., python update-attack.py cli ...). The rest of this PR (docs, Dockerfile, and the GitHub Actions workflow) still invokes python update-attack.py --attack-brand ... without a subcommand, which will fail.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Reliability Rating on New Code (required ≥ A)
7 New Code Smells (required ≤ 5)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[Copilot]

Pull request overview

Copilot reviewed 23 out of 64 changed files in this pull request and generated no new comments.

Suppressed comments (9)

update-attack.py:84

• update-attack.py defines the Typer entrypoint as a subcommand (@app.command), but main() calls app() without specifying a command. This will cause python update-attack.py --attack-brand ... (and the Dockerfile/CI invocations) to fail with a missing-command error. Use a Typer callback for the default CLI entrypoint.
  modules/resources/docs/changelogs/v19.1-v19.2/layer-enterprise.json:23
• Typo in layer technique comment: "patche" should be "patched".
  modules/resources/docs/changelogs/v19.1-v19.2/layer-enterprise.json:30
• Typo in layer technique comment: "patche" should be "patched".
  modules/resources/docs/changelogs/v19.1-v19.2/layer-enterprise.json:37
• Typo in layer technique comment: "patche" should be "patched".
  modules/resources/docs/changelogs/v19.1-v19.2/layer-enterprise.json:44
• Typo in layer technique comment: "patche" should be "patched".
  modules/resources/docs/changelogs/v19.1-v19.2/layer-enterprise.json:51
• Typo in layer technique comment: "patche" should be "patched".
  modules/resources/docs/changelogs/v19.1-v19.2/layer-enterprise.json:58
• Typo in layer technique comment: "patche" should be "patched".
  Dockerfile:85
• The Workbench API key is read from a BuildKit secret file using cat. Secret files commonly end with a trailing newline, which would become part of the password and break basic-auth. Strip newlines when exporting the key.

    if [ -f /run/secrets/workbench_api_key ]; then \
        export ATTACK_WEBSITE_WORKBENCH_API_KEY="$(cat /run/secrets/workbench_api_key)"; \
        export ATTACK_WEBSITE_WORKBENCH_USER; \

modules/resources/docs/changelogs/v19.1-v19.2/layer-enterprise.json:16

• Typo in layer technique comment: "patche" should be "patched".

This issue also appears in the following locations of the same file:

• line 23
• line 30
• line 37
• line 44
• line 51
• ...and 1 more