fix(build): escape Jinja and Actions expressions from Liquid

The Pages build failed on a Jinja url_for sample that Liquid tried to
parse, and the GitHub Actions snippets rendered blank because Liquid
resolves an unknown expression inside a dollar-brace block to an empty
string rather than erroring, silently corrupting the displayed YAML.

Every Jinja sample and every fenced block carrying Actions expressions is
now wrapped in raw tags, and a sweep over the whole site confirms no
unescaped braces remain outside raw blocks.

Author: drorganvidez

architecture/http_request.md

@@ -67,7 +67,7 @@ dataset_bp = BaseBlueprint("dataset", __name__, template_folder="templates")
 `BaseBlueprint` resolves the feature's package directory and, if the feature has an `assets/` folder, automatically adds a route that serves files from it. That is what makes this work in a template:
 
 ```
-<script src="{{ url_for('dataset.assets', subfolder='js', filename='scripts.js') }}"></script>
+{% raw %}<script src="{{ url_for('dataset.assets', subfolder='js', filename='scripts.js') }}"></script>{% endraw %}
 ```
 
 Only the `js`, `css` and `dist` subfolders are served.

architecture/splent_framework.md

@@ -149,7 +149,7 @@ dataset_bp = BaseBlueprint("dataset", __name__, template_folder="templates")
 `BaseBlueprint` is a Flask `Blueprint` that resolves the feature's package directory from its import name. If the feature has an `assets/` folder, it registers an asset route for it automatically, which is what makes this work from a template:
 
 ```
-<script src="{{ url_for('dataset.assets', subfolder='js', filename='scripts.js') }}"></script>
+{% raw %}<script src="{{ url_for('dataset.assets', subfolder='js', filename='scripts.js') }}"></script>{% endraw %}
 ```
 
 If you pass no `template_folder`, it falls back to the feature's own `templates/` directory.

ci_cd/continuous_deployment/dockerhub_workflow.md

@@ -70,18 +70,21 @@ The build needs the working copy, because the image is built from the repository
 
 ### 2. Log in to Docker Hub
 
+{% raw %}
 ```yaml
 - name: Log in to Docker Hub
   uses: docker/login-action@v3.6.0
   with:
     username: ${{ secrets.DOCKER_USER }}
     password: ${{ secrets.DOCKER_PASSWORD }}
 ```
+{% endraw %}
 
 Both credentials come from repository secrets. Use a Docker Hub access token as `DOCKER_PASSWORD` rather than your account password, so you can revoke it without changing your account.
 
 ### 3. Build and push
 
+{% raw %}
 ```yaml
 - name: Build and push Docker image
   run: |
@@ -94,6 +97,7 @@ Both credentials come from repository secrets. Use a Docker Hub access token as
     docker tag $IMAGE:$TAG $IMAGE:latest
     docker push $IMAGE:latest
 ```
+{% endraw %}
 
 Three things are worth noticing here.
 

ci_cd/continuous_deployment/webhook_workflow.md

@@ -72,6 +72,7 @@ If either condition fails, the job is skipped. A skipped job is not a failed job
 
 ## Step
 
+{% raw %}
 ```yaml
 - name: Trigger Deployment Webhook
   env:
@@ -82,6 +83,7 @@ If either condition fails, the job is skipped. A skipped job is not a failed job
       https://${{ secrets.WEBHOOK_DOMAIN }}/webhook/deploy \
       -H "Authorization: Bearer ${{ secrets.WEBHOOK_TOKEN }}"
 ```
+{% endraw %}
 
 GitHub does not have access to the server. It only sends a signed request and the server does the work.
 

ci_cd/continuous_integration/testing_workflow.md

@@ -68,7 +68,7 @@ The runner image is pinned to an explicit Ubuntu version rather than `ubuntu-lat
 
 ## Environment variables
 
-The job declares the database configuration once at job level, and the service container reuses it through `${{ env.* }}`:
+The job declares the database configuration once at job level, and the service container reuses it through `{% raw %}${{ env.* }}{% endraw %}`:
 
 | Variable | Value |
 |:---|:---|
@@ -87,6 +87,7 @@ The job declares the database configuration once at job level, and the service c
 
 A MariaDB container is started alongside the job:
 
+{% raw %}
 ```yaml
 services:
   mariadb:
@@ -104,6 +105,7 @@ services:
       --health-timeout=5s
       --health-retries=3
 ```
+{% endraw %}
 
 The health check uses `mariadb-admin`, which is the MariaDB client binary. The job does not start running steps until the health check passes, so the database is ready before the first test connects.