Scanner does not suppress bare .svc (cluster-local) hostnames

[rubambiza]

Describe the bug

@esnible reported (rossoctl/cortex#532, rossoctl/cortex#533) that the link-health scanner flagged a Kubernetes cluster-local URL:

http://keycloak-service.keycloak.svc:8080/realms/

These .svc DNS names resolve only inside a cluster and can never be checked by an external scanner, so they should be suppressed.

Root cause

The scanner (skills/link-health-scanner/scripts/link-health-scanner.sh) already suppresses several unreachable-by-design hostname classes:

• *.svc.cluster.local
• *.local
• RFC1918 ranges (10.*, 172.16-31.*, 192.168.*)
• lychee --exclude-all-private

A bare .svc hostname (no .cluster.local suffix) is not covered: it does not match .svc.cluster.local, it is not a numeric RFC1918 address, and it resolves to nothing so --exclude-all-private does not catch it.

Proposed fix

Add a bare-.svc clause alongside the existing suppression lines in the error_map jq filter:

select(.url | test("://[^/]*\\.svc([:/]|$)") | not) |

This subsumes the existing .svc.cluster.local clause, which can be removed.

Note

The related "URLs inside code blocks" concern from kagenti-extensions#533 is already handled: the lychee version in the scanner's runtime environment excludes URLs inside inline code spans and fenced code blocks by default (verified). Locking that behavior in is tracked separately.

Additional context

• Reported by @esnible via 🐛 Broken link in authbridge/demos/github-issue/demo-aiac.md: http://keycloak-service.keycloak.svc:8080/admin/realms/kagenti/clients cortex#532 and 🐛 Broken link in authbridge/demos/github-issue/demo-aiac.md: http://keycloak-service.keycloak.svc:8080/realms/ cortex#533.
• The same scanner logic lives in kagenti/automation; a companion issue tracks the fix there.

[rubambiza]

Mirror: rossoctl/automation#23 tracks the same fix in the automation copy of the scanner.