You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Install the selected Copilot skills, correct site spacing and accent contrast, restore the legacy redirect, and validate contrast and redirect behavior.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Preserve valid command paths and local Markdown links, and add regressions for the reviewed cases.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The example alternative also matches the prefix of the common examples/ directory, so broken links such as [Guide](examples/missing.md) are silently skipped instead of checked. Match example as a whole placeholder component rather than as an arbitrary prefix.
Include manifests with no scripts in the inventory
A valid package.json may omit scripts entirely. In that case this omits the package from the inventory, so if not npm_scripts later skips checking npm run build even though the command fails. Record an empty script set for manifests without a scripts field, as is already done for "scripts": {}.
Handle tilde fences and match closing fence length
This only recognizes backtick fences, so commands in valid ~~~ Markdown fences are never checked. It also treats a shorter backtick run inside a longer fence as its end. Track the opening character and length, and only close on a matching fence with no trailing content.
Markdown code spans can cross line breaks, but applying INLINE_CODE to each line separately leaves the interior visible to the link checker. For example, a code span containing a line [example](missing.md) produces a spurious broken-link finding. Track inline-code delimiters across lines while preserving the original line numbers.
Exclude PowerShell environment assignments from input reads
This treats PowerShell environment assignments as reads: $env:API_TOKEN = 'fixed' is counted as consuming API_TOKEN. Consequently the audit can accept a documented input that the script actually overwrites, and also report write-only variables as undocumented inputs. Distinguish assignments and comments from actual reads.
Preserve PowerShell environment-variable case on case-sensitive platforms
Uppercasing every PowerShell name conflates distinct environment variables on Linux and macOS, where $env:api_token and $env:API_TOKEN differ. An .env.example declaration of API_TOKEN can therefore be incorrectly matched to a read of $env:api_token. Preserve the original spelling and make code/documentation matching account for the target platform's case sensitivity.
Parenthesized multiline imports are not captured by FROM_IMPORT_SPEC: for from package import ( followed by config on the next line, this loop sees only (. Consequently, a live package/config.py can be marked unreferenced and its documented environment settings reported as ineffective. Parse Python imports with ast while retaining the existing handling for other languages.
Recognize explicit PowerShell variables in documentation
The PowerShell code scanner recognizes $env:windir and $env:COMPUTERNAME, but the documentation scanner rejects lowercase names and names without underscores. Even explicitly documented PowerShell variables are therefore reported as undocumented. Recognize explicit $env:NAME references separately from bare-token heuristics and apply the same case-matching policy in both inventories.
Check Makefile presence even when no targets are extracted
When a Makefile exists but contains no explicit targets (for example, only variable assignments), make_targets is empty and this skips every documented make command. Thus make all is silently accepted even though it fails. Check Makefile presence independently of the extracted target set.
Valid Markdown destinations can contain balanced parentheses. For example, [Linux setup](docs/setup_(linux).md) is parsed as docs/setup_(linux, so an existing link is reported as broken. Parse balanced or escaped parentheses in link destinations instead of stopping at the first ).
Require segment boundaries for exact placeholder names
The placeholder alternatives match prefixes of path segments, so a normal link such as examples/install.md is classified as a placeholder and never checked, even when the file is missing. Require a segment boundary for exact placeholder names while retaining intentional prefixes such as your-.
Require whitespace after closing Markdown fence markers
A closing Markdown fence may only have whitespace after its marker, but this accepts a line such as ```python as a close. Inside a fenced example, that exposes subsequent fake links to checking and can hide real links after the actual closing fence. Require a whitespace-only suffix here and in fenced_block_groups at lines 195–197.
Markdown inline code spans may cross line breaks, but masking each line independently leaves their contents visible to the link checker. For example, a span containing [example](missing.md) on a subsequent line is incorrectly reported as a broken link. Track backtick spans across lines while preserving their line numbers.
Exclude strings and comments from environment-read scanning
Scanning raw source lines also counts environment reads inside strings and comments. For example, tests/test_docs_drift.py:102 embeds os.getenv('API_TOKEN') in a fixture string, which this scan counts as a configuration read and can turn into spurious env findings. Distinguish executable reads from fixture text and comments before adding names to the inventory.
Exclude PowerShell environment assignments from read detection
This treats every PowerShell environment-variable occurrence as a read, including assignments such as $env:BUILD_MODE = 'release'. Consequently, scripts that only set a variable are reported as depending on undocumented configuration. Distinguish assignments from actual reads before adding the name to found.
Limit environment inventory to recognized sample files
This treats every .env* file, including runtime .env and .env.local files, as documentation. When filesystem fallback includes a developer's local env file, its keys suppress undocumented-env findings even though no documentation or sample contains them, and the audit unnecessarily reads that file. Restrict this inventory to explicitly recognized sample/example files.
This requires at least three characters, so legitimate keys such as CI or TZ in .env.example are discarded even though the code-read patterns accept them. Consequently a documented process.env.CI is incorrectly reported as undocumented. Allow short environment variable names in the sample-file inventory without broadening the prose heuristic.
Track Makefile targets by invocation working directory
Make targets are merged across every Makefile, so a target in packages/web/Makefile makes a broken root-level make deploy appear valid; an existing Makefile with no targets also suppresses missing-target checks altogether. Track Makefile presence and targets by the invocation's working directory, including cd and make -C, and distinguish a missing Makefile from an empty target set.
Resolve script paths against the effective working directory
Script paths are checked against the repository and document directories, but not the working directory tracked after cd. For example, cd tools followed by python scripts/check.py is reported missing when tools/scripts/check.py exists; conversely, a root-level file can make a broken command pass. Resolve script paths against the effective directory at each invocation, including directory changes on the same line.
Exclude all absolute URI schemes from filesystem checks
This skips only a fixed set of URL schemes, so valid links such as ftp://host/file or vscode://... are treated as repository-relative paths and reported as broken. Exclude all absolute URI schemes before checking the filesystem.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The documentation audit misvalidates commands and links, while the security and accessibility guidance can overlook unsafe fork workflows and insufficient contrast.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Unresolved parsing and inventory errors can hide broken links and script paths or falsely flag valid Make targets and documented environment variables.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The environment-variable scanner misses reads in compound assignments and increments, causing documented variables to be incorrectly reported as unused.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The audit scanner can produce false findings because it misses valid environment-variable reads, silently skips source files, and misinterprets Markdown comments, code blocks, and link titles.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github-actions-hardening,docs-sync-audit, andweb-design-reviewer./ConfigMgr-OSD/redirect and add redirect/contrast validation.Validation
git diff --checkpassed.