Promote the Media Parser Fuzz Gate Retirement to Main

.github/actions/validate/action.yml

@@ -30,11 +30,6 @@ runs:
       shell: bash
       run: python3 checks/media_metadata_gate.py
 
-    # The carried tree is all well formed, so this feeds the same parsers seeded malformed variants.
-    - name: Fuzz media parsers step
-      shell: bash
-      run: python3 checks/media_parser_fuzz_gate.py
-
     # A redacted image replaced by its original passes every other check, so this compares hashes.
     - name: Check media redactions step
       shell: bash

.github/workflows/deploy-site.yml

@@ -40,7 +40,7 @@ jobs:
   validate:
     name: Validate sources job
     needs: [ assert-ref ]
-    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@d7041d8ce15356dfd9223e54d74c64d464f28335 # 2.0.1192
+    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@1faf16c708bbe5fe6c4e053de0e327dd07b05b8c # 2.0.1209
     permissions:
       contents: read
     with:
@@ -58,7 +58,7 @@ jobs:
   deploy:
     name: Deploy site job
     needs: [ validate ]
-    uses: ptr727/ProjectTemplate/.github/workflows/deploy-site-task.yml@d7041d8ce15356dfd9223e54d74c64d464f28335 # 2.0.1192
+    uses: ptr727/ProjectTemplate/.github/workflows/deploy-site-task.yml@1faf16c708bbe5fe6c4e053de0e327dd07b05b8c # 2.0.1209
     with:
       environment: ${{ inputs.environment }}
     permissions:

.github/workflows/merge-bot-pull-request.yml

@@ -18,7 +18,7 @@ jobs:
 
   merge-bot:
     name: Merge bot pull request job
-    uses: ptr727/ProjectTemplate/.github/workflows/merge-bot-task.yml@d7041d8ce15356dfd9223e54d74c64d464f28335 # 2.0.1192
+    uses: ptr727/ProjectTemplate/.github/workflows/merge-bot-task.yml@1faf16c708bbe5fe6c4e053de0e327dd07b05b8c # 2.0.1209
     secrets:
       CODEGEN_APP_CLIENT_ID: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
       CODEGEN_APP_PRIVATE_KEY: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}

.github/workflows/publish-release.yml

@@ -16,7 +16,7 @@ jobs:
   # Also replaces this repo's own dispatch-ref assertion: the hub task errors identically on a ref other than main/develop.
   plan:
     name: Plan release job
-    uses: ptr727/ProjectTemplate/.github/workflows/publish-plan-task.yml@d7041d8ce15356dfd9223e54d74c64d464f28335 # 2.0.1192
+    uses: ptr727/ProjectTemplate/.github/workflows/publish-plan-task.yml@1faf16c708bbe5fe6c4e053de0e327dd07b05b8c # 2.0.1209
     with:
       event_name: ${{ github.event_name }}
       actor: ${{ github.actor }}
@@ -30,7 +30,7 @@ jobs:
     name: Validate sources job
     needs: [plan]
     if: ${{ needs.plan.outputs.publish == 'true' }}
-    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@d7041d8ce15356dfd9223e54d74c64d464f28335 # 2.0.1192
+    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@1faf16c708bbe5fe6c4e053de0e327dd07b05b8c # 2.0.1209
     permissions:
       contents: read
     with:
@@ -54,7 +54,7 @@ jobs:
     # An if: on a job replaces the implicit success() over its needs.
     # Without the validate arm a failed gate would publish anyway.
     if: ${{ needs.plan.outputs.publish == 'true' && needs.validate.result == 'success' }}
-    uses: ptr727/ProjectTemplate/.github/workflows/build-release-task.yml@d7041d8ce15356dfd9223e54d74c64d464f28335 # 2.0.1192
+    uses: ptr727/ProjectTemplate/.github/workflows/build-release-task.yml@1faf16c708bbe5fe6c4e053de0e327dd07b05b8c # 2.0.1209
     permissions:
       contents: write
       actions: write

.github/workflows/test-pull-request.yml

@@ -19,7 +19,7 @@ jobs:
 
   validate:
     name: Validate sources job
-    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@d7041d8ce15356dfd9223e54d74c64d464f28335 # 2.0.1192
+    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@1faf16c708bbe5fe6c4e053de0e327dd07b05b8c # 2.0.1209
     permissions:
       contents: read
     with:

README.md

@@ -142,7 +142,7 @@ A post is public the moment it deploys, and a photo or a pasted configuration ca
 - **Redactions.** A house number, a face, or a serial number is covered with a flat opaque fill, never a blur. A fill on an image already published is declared in [`checks/media-redactions.json`][media-redactions] and applied by a script. [`checks/media_redactions_gate.py`][media-redactions-gate] fails when a redacted file no longer matches its recorded hash, which is how a quietly restored original is caught.
 - **Text.** [`checks/text_pii_gate.py`][text-pii-gate] reads every page and post under `content/` outside the imported archive years, front matter and code blocks included. It reports email addresses, hardware addresses, public IP addresses, coordinates, street addresses, and phone numbers. It also reports a URL that carries coordinates or names one specific sensor or station. A finding names the file, the line, and the class, never the value, so the CI log does not republish it. A value a post prints on purpose is declared in an allow file with a reason, and an entry that stops matching fails the gate.
 
-A fuzzer feeds the metadata parsers malformed images in the same action, because the carried tree is all well formed and would never exercise a refusal. What no gate can judge, whether a picture locates the home or identifies a person, is the checklist in [CONTENT.md][content].
+What no gate can judge, whether a picture locates the home or identifies a person, is the checklist in [CONTENT.md][content].
 
 ### What Happens While the Site Runs
 

checks/README.md

@@ -13,7 +13,6 @@ This README covers the URL contract alone. The other checks in this directory ea
 | [`media_metadata_gate.py`][media-metadata-gate] | carried media is not in a form the gate can vouch for |
 | [`media_redactions_gate.py`][media-redactions-gate] | a file declared in `media-redactions.json` is not its redacted result |
 | [`text_pii_gate.py`][text-pii-gate] | a Markdown file under `content/`, outside the imported archive years, carries personal data in its text |
-| [`media_parser_fuzz_gate.py`][media-parser-fuzz-gate] | malformed input breaks the media gate or its normalizer |
 
 ## Why this exists
 
@@ -200,4 +199,3 @@ Three traps in that adjudication, each of which produced a wrong answer first an
 [url-parity-gate]: ./url_parity_gate.py
 [deploy-readme-redirects]: ../deploy/README.md#how-the-redirects-are-expressed
 [deploy-readme-security-headers]: ../deploy/README.md#security-headers
-[media-parser-fuzz-gate]: ./media_parser_fuzz_gate.py