From 9b94fc25cdb723d672ac3c76b5cf9e80bcaf8c21 Mon Sep 17 00:00:00 2001 From: Gloire Rubambiza Date: Tue, 14 Jul 2026 17:02:57 -0400 Subject: [PATCH 1/2] fix: Suppress bare .svc hostnames in link scanner Cluster-local Kubernetes service URLs such as http://keycloak-service.keycloak.svc:8080/realms/ were reported as broken links. They matched none of the existing suppression clauses: no .svc.cluster.local suffix, non-numeric so not RFC1918, and they resolve to nothing so lychee --exclude-all-private does not catch them. Add a bare-.svc suppression clause before the cluster-local one. Assisted-By: Claude Code (Anthropic AI) Signed-off-by: Gloire Rubambiza --- skills/link-health-scanner/scripts/link-health-scanner.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/skills/link-health-scanner/scripts/link-health-scanner.sh b/skills/link-health-scanner/scripts/link-health-scanner.sh index d27292f..c857bcf 100644 --- a/skills/link-health-scanner/scripts/link-health-scanner.sh +++ b/skills/link-health-scanner/scripts/link-health-scanner.sh @@ -146,7 +146,10 @@ for repo_dir in "$REPOS_DIR"/*/ "$REPOS_DIR"/.github/; do .key as $filepath | .value[] | select(.url | test("^https?://")) | - # Suppress unreachable-by-design hostnames at URL level + # Suppress unreachable-by-design hostnames at URL level. + # Bare .svc covers both plain cluster-local service names (foo.ns.svc) and + # the fully-qualified foo.ns.svc.cluster.local form. + select(.url | test("://[^/]*\\.svc([:/]|$)") | not) | select(.url | test("://[^/]*\\.svc\\.cluster\\.local([:/]|$)") | not) | select(.url | test("://[^/]*\\.local([:/]|$)") | not) | select(.url | test("://(10\\.[0-9]|172\\.(1[6-9]|2[0-9]|3[01])\\.[0-9]|192\\.168\\.[0-9])[0-9.]*([:/]|$)") | not) | From 9189ff32a7ed48692472089a17a3759823e8608b Mon Sep 17 00:00:00 2001 From: Gloire Rubambiza Date: Tue, 14 Jul 2026 17:03:48 -0400 Subject: [PATCH 2/2] docs: Pin minimum lychee version to 0.23.0 The scanner depends on lychee's default exclusion of URLs inside code blocks. Pin a known-good minimum version and document the dependency so a version change cannot silently reintroduce code-block false positives. Assisted-By: Claude Code (Anthropic AI) Signed-off-by: Gloire Rubambiza --- skills/link-health-scanner/SKILL.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/skills/link-health-scanner/SKILL.md b/skills/link-health-scanner/SKILL.md index 78bb983..628bc5c 100644 --- a/skills/link-health-scanner/SKILL.md +++ b/skills/link-health-scanner/SKILL.md @@ -17,7 +17,8 @@ Scan all repositories in a GitHub organization for broken links. Creates GitHub ## Prerequisites - `bash` 4+ (macOS ships 3.2; use `brew install bash` for 4+) -- `lychee` (link checker: `brew install lychee`) +- `lychee` >= 0.23.0 (link checker: `brew install lychee`) — the scanner relies on + lychee's default exclusion of URLs inside code blocks; do not pass `--include-verbatim` - `gh` (GitHub CLI, authenticated with org access) - `jq` (JSON processor)