fix(scripts): resolve URL scheme safety and method complexity in check_upstream_updates.py

[tonythethompson]

Summary

• Resolves Fix 'Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.' issue in scripts\check_upstream_updates.py #98: Enforces strict \http\ / \https\ URL scheme validation with non-empty hostname via \�nsure_http_url, _HttpOnlyRedirectHandler, and \http_opener()\ to prevent redirection or request escalation to unexpected schemes (e.g. \ile:/).
• Resolves Fix 'Complex Method' issue in scripts\check_upstream_updates.py #99: Decomposes \�udit_entry\ in \scripts/check_upstream_updates.py\ into focused helper methods (_check_tag_moved, _check_has_new_tag, _determine_status) reducing cyclomatic complexity.
• Adds comprehensive unit tests for URL validation, redirect handlers, and status determination in \scripts/test_check_upstream_updates.py.

Fixes #98
Fixes #99

---

Summary by cubic

Restricts all GitHub API requests and redirects to http/https with a host, and refactors audit_entry into focused helpers to reduce complexity. Previously redirects could target non-http(s) schemes; now invalid URLs or redirects fail fast, and status computation is isolated and easier to review.

• fetch_github_json calls ensure_http_url and uses http_opener().open; invalid URLs/redirects raise ValueError before the request.
• Adds _HttpOnlyRedirectHandler and HTTP_SCHEMES to enforce http/https-only redirects.
• Splits audit_entry into _check_tag_moved, _check_has_new_tag, and _determine_status; behavior is unchanged aside from stricter URL/redirect validation.
• Adds unit tests for URL validation, redirect handling, helper logic, and opener construction in scripts/test_check_upstream_updates.py.
• No migration required; inputs, outputs, and statuses are unchanged.

^{Written for commit 400566a. Summary will update on new commits.}

[sourcery-ai]

Sorry @tonythethompson, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a8581949-8817-49e8-a1e3-f95049d662d8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[linear-code]

TS-198

[opencode-agent]

Findings

• [P1] Prevent credential-bearing cross-origin redirects at scripts/check_upstream_updates.py:61. The guard permits any HTTP(S) hostname, and urllib copies the Authorization header during redirects, exposing GITHUB_TOKEN to arbitrary hosts or via HTTPS-to-HTTP downgrade. Restrict redirects to the trusted origin and HTTPS, or strip credentials when the origin changes.

Validation

• Full suite passed: 158 tests.

opencode session  |  github run

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• scripts/check_upstream_updates.py
• scripts/test_check_upstream_updates.py

---

_{Reviewed by step-3.7-flash · Input: 124.3K · Output: 15.4K · Cached: 459.3K}

_{Review guidance: REVIEW.md from base branch main}