ci: harden auto-merge policy for live mode

[sonpiaz]

Summary

• parse candidate files with pinned yaml@2.8.3 instead of trusting line regexes
• require parsed verified === false, HTTPS product/signup URLs, and slug/filename parity
• reject malformed YAML, duplicate keys, aliases, scalar/list documents, and oversized input before classification
• bound raw GitHub downloads to 20 KB and 10 seconds
• test duplicate verified keys, string booleans, malformed YAML, slug mismatch, response headers/streams, and timeout behavior

Reviewer follow-up

• M-1 required: implemented here with a real YAML parser and exact boolean assertion
• M-3 required: already merged in feat: generate safer SEO and GEO surfaces #106; every JSON-LD emitter now escapes HTML-significant characters
• M-4 optional: implemented here with timeout and streaming byte cap
• M-2 optional: contents: write is retained because GitHub native auto-merge requires it together with pull-requests: write. The job still checks out only the trusted base SHA, installs one pinned parser with lifecycle scripts disabled, and never executes contributor code.

Safety and rollout

This PR does not enable LIVE mode or alter repository settings. allow_auto_merge remains false and AUTO_MERGE_ENABLED remains absent.

After this PR receives independent approval, the one-time owner settings remain:

1. protect main and require pull requests;
2. require both Validate and Validate Programs checks;
3. enable GitHub native auto-merge and keep squash enabled;
4. set AUTO_MERGE_ENABLED=true.

Backtest

Replayed the exact September 20-PR cohort through the hardened parser:

• 12 candidates
• 8 blocked
• Add Serphiq affiliate program #93 and Atlabs affiliate program #96 moved from candidate to blocked because their submitted multiline YAML is syntactically invalid

The lower rate is intentional: these two PRs previously relied on downstream CI to catch invalid YAML; the classifier now fails closed itself.

Verification

• policy tests: 8/8 pass
• historical raw-file fetches exercised the 10-second/20-KB reader
• lint: 0 errors, 23 pre-existing warnings
• TypeScript: pass
• production build: 884 pages
• workflow YAML and embedded JavaScript parse successfully

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
open-affiliate	Ready	Preview	Sep 14, 2026 8:59pm UTC

[github-actions]

Auto-merge policy — SHADOW

⛔ Blocked

• changes more than 3 program files
• sensitive or non-program path: .github/scripts/auto-merge-policy.cjs
• sensitive or non-program path: .github/scripts/auto-merge-policy.test.cjs
• sensitive or non-program path: .github/scripts/package-lock.json
• sensitive or non-program path: .github/scripts/package.json
• sensitive or non-program path: .github/workflows/auto-merge.yml
• sensitive or non-program path: .github/workflows/ci.yml
• sensitive or non-program path: .gitignore

Human review is required; auto-merge was not requested.

The workflow never executes pull-request code with its write token
and never falls back to a direct merge.

[sonpiaz]

Review blocker fixed in c47c31c: replaced the unref’d AbortSignal.timeout() with an explicit ref’d AbortController timer that is cleared in finally. This strengthens runtime timeout behavior and keeps the isolated Node 22 timeout test alive. The full policy suite passed 3/3 consecutive runs locally (8/8 each); CI is rerunning.