fix(release): bound anonymous repository probe

[kazazes]

Promotion record

• authoritative private candidate: bb94344a6521a7f4f0ba08586e494d5fa60cf590
• exported files: 514
• withheld internal files: 26
• export tree SHA-256: 3d50487001a49c257ea8e77998e6aed9c30b3e3c2d6347c430ba40f6c9908c1f

Summary by CodeRabbit

• Bug Fixes
  • Improved external-link verification when requiring publicly reachable repositories.
  • Reduced redundant reachability checks while preserving validation for local repository links and documentation origins.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 957547ad-6c08-4d55-92c3-378225ebe80d

📥 Commits

Reviewing files that changed from the base of the PR and between 4e883a7 and 8468c6e.

📒 Files selected for processing (1)

• docs/site/check-external-links.mjs

---

📝 Walkthrough

Walkthrough

When --require-public is enabled, the external-link checker makes one bounded request to the repository release-tag tree. Local repository-link validation and canonical-origin checks remain unchanged.

Changes

External link validation

Layer / File(s)	Summary
Bounded repository reachability check docs/site/check-external-links.mjs	The checker replaces repository and project URL reachability checks with one request to the approved repository origin and path prefix.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: audeberc

Poem

A rabbit checks one trusted door,
The bounded path is clear once more.
Local links still stand their ground,
Canonical checks keep watch around.
One neat request hops safely through.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: bounding anonymous repository probing during release validation.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/fde-714-bounded-anonymous-reachability

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4e883a7ed4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restore reachability checks for metadata endpoints

When the repository root remains public but a project endpoint is unavailable—for example, Issues is disabled or /security/policy no longer resolves—this single root request succeeds even though the wheel's advertised [project.urls] link is broken. projectMetadataUrls() only compares those URLs with a hard-coded map, and the local repository-link validation never checks endpoint availability, so removing the small projectUrls reachability loop allows the publication gate in .github/workflows/release.yml to promote packages with dead metadata links; keep bounded probes for these distinct metadata destinations.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve validation for links targeting main

When the workflow resumes an older tagged release after main has removed or renamed a source file, the local check validates the link against the old release checkout even though generated links such as those from docs/astro.config.mjs target blob/main/.... The recovery path in .github/workflows/release.yml explicitly permits the release tag to be an ancestor of the current workflow commit, so repository-root reachability does not prove those moving-branch URLs exist and the gate can promote documentation containing broken source links; retain a bounded way to validate main targets or generate immutable links instead.

Useful? React with 👍 / 👎.