Repair external symlinks that prevent the validator action from unpacking

[hyperpolymath]

GitHub cannot unpack the K9 action repository because four symlinks point outside the repository to the former standards monorepo's _shared tree. This fails consumers before the validation action starts, including Hypatia and cicd-suite.

Materialize the four existing shared files from the canonical standards source as ordinary files, retaining their content and licence headers. Add a repository-archive link check and controls that reject dangling and escaping links while accepting internal links.

Validation: K9 validator regression tests pass; archive-link positive/negative controls pass; all links in the repaired checkout pass. Consumer CI will additionally verify that GitHub can unpack and execute the action from this commit.

Related incident: hyperpolymath/natsci-studio#82, hyperpolymath/fraying-model-computational-testbed#65, hyperpolymath/cicd-suite#5, and hyperpolymath/hypatia#769.

[coderabbitai]

Warning

Review limit reached

Next included review available in 53 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e55ea7d7-870c-47b2-8ba2-53c0233b411b

📥 Commits

Reviewing files that changed from the base of the PR and between 2ee51ee and 0c185ea.

📒 Files selected for processing (1)

• .github/workflows/validate-action-tests.yml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3b7c55d4-0028-4d1d-b838-6e20c557b5d7

📥 Commits

Reviewing files that changed from the base of the PR and between 347ee5d and 2ee51ee.

📒 Files selected for processing (11)

• .github/workflows/validate-action-tests.yml
• editors/vscode/container/.gatekeeper.yaml
• editors/vscode/container/.gatekeeper.yaml
• pandoc/container/.gatekeeper.yaml
• pandoc/container/.gatekeeper.yaml
• site/assets/style.css
• site/assets/style.css
• site/templates/default.html
• site/templates/default.html
• validate-action/tests/check-archive-links.sh
• validate-action/tests/test-archive-links.sh

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Analyze (rust)

⚠️ CI failures not shown inline (2)

GitHub Actions: Code scanning AI findings on PR #43 / 0_github-advanced-security.txt: Code scanning AI findings on PR #43

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mecho "RUNNER_TEMP=$RUNNER_TEMP"�[0m
 �[36;1mfind "$RUNNER_TEMP" -maxdepth 1 -type f -name 'git-credentials-*.config' -print -delete�[0m
 �[36;1m�[0m
 �[36;1m# Generate a unique token and stop processing workflow commands to prevent the runtime from injecting commands�[0m
 �[36;1mSTOP_***REDACTED_SECRET_ASSIGNMENT*** /proc/sys/kernel/random/uuid)�[0m
 �[36;1m�[0m
 �[36;1m# Use a trap to ensure we always resume command processing and check for�[0m
 �[36;1m# fallback error annotations, even if the runtime exits with a non-zero code�[0m
 �[36;1m# (which would otherwise cause set -e to abort the shell before we get here).�[0m
 �[36;1m# The trap preserves the original exit code.�[0m
 �[36;1mcopilot_cleanup() {�[0m
 �[36;1m  �[0m
 �[36;1m  if [ -n "${GIT_PROXY_PID:-}" ] && kill -0 "$GIT_PROXY_PID" 2>/dev/null; then�[0m
 �[36;1m    echo "Stopping git-proxy (pid=$GIT_PROXY_PID)..."�[0m
 �[36;1m    kill "$GIT_PROXY_PID" 2>/dev/null || true�[0m
 �[36;1m    for _ in {1..25}; do�[0m
 �[36;1m      if ! kill -0 "$GIT_PROXY_PID" 2>/dev/null; then break; fi�[0m
 �[36;1m      sleep 0.2�[0m
 �[36;1m    done�[0m
 �[36;1m    if kill -0 "$GIT_PROXY_PID" 2>/dev/null; then�[0m
 �[36;1m      echo "git-proxy did not stop gracefully; forcing termination."�[0m
 �[36;1m      kill -KILL "$GIT_PROXY_PID" 2>/dev/null || true�[0m
 �[36;1m    fi�[0m
 �[36;1m    wait "$GIT_PROXY_PID" 2>/dev/null || true�[0m
 �[36;1m  fi�[0m
 �[36;1m  �[0m
 �[36;1m  echo "::$STOP_***REDACTED_SECRET_ASSIGNMENT***
 �[36;1m  FALLBACK_FILE="${RUNNER_TEMP}/copilot-fallback-error.txt"�[0m
 �[36;1m  if [ -f "$FALLBACK_FILE" ]; then�[0m
 �[36;1m    FALLBACK_MSG=$(head -c 500 "$FALLBACK_FILE" | tr -d '\n\r')�[0m
 �[36;1m    echo "::error title=Copilot Error::${FALLBACK_MSG}"�[0m

---

GitHub Actions: Code scanning AI findings on PR #43 / github-advanced-security: Code scanning AI findings on PR #43

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mecho "RUNNER_TEMP=$RUNNER_TEMP"�[0m
 �[36;1mfind "$RUNNER_TEMP" -maxdepth 1 -type f -name 'git-credentials-*.config' -print -delete�[0m
 �[36;1m�[0m
 �[36;1m# Generate a unique token and stop processing workflow commands to prevent the runtime from injecting commands�[0m
 �[36;1mSTOP_***REDACTED_SECRET_ASSIGNMENT*** /proc/sys/kernel/random/uuid)�[0m
 �[36;1m�[0m
 �[36;1m# Use a trap to ensure we always resume command processing and check for�[0m
 �[36;1m# fallback error annotations, even if the runtime exits with a non-zero code�[0m
 �[36;1m# (which would otherwise cause set -e to abort the shell before we get here).�[0m
 �[36;1m# The trap preserves the original exit code.�[0m
 �[36;1mcopilot_cleanup() {�[0m
 �[36;1m  �[0m
 �[36;1m  if [ -n "${GIT_PROXY_PID:-}" ] && kill -0 "$GIT_PROXY_PID" 2>/dev/null; then�[0m
 �[36;1m    echo "Stopping git-proxy (pid=$GIT_PROXY_PID)..."�[0m
 �[36;1m    kill "$GIT_PROXY_PID" 2>/dev/null || true�[0m
 �[36;1m    for _ in {1..25}; do�[0m
 �[36;1m      if ! kill -0 "$GIT_PROXY_PID" 2>/dev/null; then break; fi�[0m
 �[36;1m      sleep 0.2�[0m
 �[36;1m    done�[0m
 �[36;1m    if kill -0 "$GIT_PROXY_PID" 2>/dev/null; then�[0m
 �[36;1m      echo "git-proxy did not stop gracefully; forcing termination."�[0m
 �[36;1m      kill -KILL "$GIT_PROXY_PID" 2>/dev/null || true�[0m
 �[36;1m    fi�[0m
 �[36;1m    wait "$GIT_PROXY_PID" 2>/dev/null || true�[0m
 �[36;1m  fi�[0m
 �[36;1m  �[0m
 �[36;1m  echo "::$STOP_***REDACTED_SECRET_ASSIGNMENT***
 �[36;1m  FALLBACK_FILE="${RUNNER_TEMP}/copilot-fallback-error.txt"�[0m
 �[36;1m  if [ -f "$FALLBACK_FILE" ]; then�[0m
 �[36;1m    FALLBACK_MSG=$(head -c 500 "$FALLBACK_FILE" | tr -d '\n\r')�[0m
 �[36;1m    echo "::error title=Copilot Error::${FALLBACK_MSG}"�[0m

🔇 Additional comments (6)

validate-action/tests/check-archive-links.sh (1)

1-17: LGTM!

validate-action/tests/test-archive-links.sh (1)

1-23: LGTM!

.github/workflows/validate-action-tests.yml (1)

9-11: LGTM!

Also applies to: 17-19, 36-44

site/assets/style.css (1)

1-121: LGTM!

site/templates/default.html (1)

21-21: 🎯 Functional Correctness

Do not change this placeholder based on the current evidence.

The site pages define brand explicitly, so {{brand}} is not shown to be unresolved. site/downloads.adoc and site/roadmap.adoc omit both brand and site, so replacing the placeholder with {{site}} would not fix those pages. The repository does not establish that ddraig-ssg restricts template data to the variables listed in the comment.

pandoc/container/.gatekeeper.yaml (1)

68-70: 🩺 Stability & Availability

No change required in these template files.

Both .gatekeeper.yaml files are source templates. The repository documents just container-init or just init as the step that replaces their placeholders. The compose examples mount a named volume and instruct users to copy the policy into it after initialisation; they do not mount these files directly.

---

📝 Summary

Summary by CodeRabbit

• New Features

  • Added a shared site template with consistent navigation, metadata, licensing details and content layout.
  • Added a responsive, accessible site theme supporting light and dark colour schemes, keyboard focus styling, reduced motion and readable page components.
  • Added strengthened request protection and validation policies for supported container services.

• Bug Fixes

  • Improved archive validation to detect broken links and links that point outside the repository before release.

Walkthrough

The pull request adds archive symlink validation to CI, introduces a Svalinn gateway policy, and replaces shared site references with local CSS and HTML template files.

Changes

Archive and site validation

Layer / File(s)	Summary
Archive link validation .github/workflows/validate-action-tests.yml, validate-action/tests/*	The workflow tests archive links and validates symlinks in an extracted Git archive. The checker rejects dangling links and links outside the archive root.
Container gatekeeper policy editors/vscode/container/.gatekeeper.yaml, pandoc/container/.gatekeeper.yaml	The shared configuration references are removed. The Pandoc file now contains Svalinn route, authentication, rate-limit, validation, CORS, and audit-logging rules.
Site presentation site/assets/style.css, site/templates/default.html	The site gains local responsive styles and a shared HTML template with metadata, navigation, accessibility controls, licensing, and footer content.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🔵 Low · up to 2ee51

The site template may render without its expected brand in generated page headers. This is a bounded presentation issue and does not otherwise block the archive-link repair.

Sequence Diagram(s)

sequenceDiagram
  participant GitHub Actions
  participant Git archive
  participant check-archive-links.sh
  GitHub Actions->>Git archive: Extract HEAD
  Git archive-->>GitHub Actions: Provide archive tree
  GitHub Actions->>check-archive-links.sh: Validate archive symlinks
  check-archive-links.sh-->>GitHub Actions: Return pass or failure status

Loading

Possibly related PRs

• hyperpolymath/k9-ecosystem#42: Adds related archive-symlink safeguards that this pull request extends to extracted archives.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the primary change: repairing external symlinks that prevent the validator action repository from being unpacked.
Description check	✅ Passed	The description is directly related to the changes. It explains the symlink repairs, archive-link checks, validation coverage, and affected consumers.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud