fix: validate rendered Markdown link targets

Author: CometAPI

scripts/_checks.py

@@ -18,6 +18,8 @@
 from typing import cast
 from urllib.parse import quote, unquote
 
+from markdown_it import MarkdownIt
+
 if sys.version_info >= (3, 11):
     import tomllib
 else:
@@ -194,6 +196,18 @@ def _actions_path_has_canonical_url(
     return False
 
 
+def _rendered_markdown_link_targets(text: str) -> list[str]:
+    targets: list[str] = []
+    for token in MarkdownIt("commonmark", {"html": True}).parse(text):
+        for child in token.children or []:
+            if child.type != "link_open":
+                continue
+            target = child.attrGet("href")
+            if isinstance(target, str):
+                targets.append(target)
+    return targets
+
+
 _WHEEL_DIGEST = re.compile(
     r"\bwheel\s+sha256\b[^0-9a-f]{0,96}(?P<digest>[0-9a-f]{64})(?![0-9a-f])",
     re.IGNORECASE | re.DOTALL,
@@ -762,6 +776,12 @@ def _canonical_actions_run_violations(
         )
         for variant in variants
     ]
+    malformed = malformed or any(
+        _ACTIONS_PATH.search(target) is not None
+        and _CANONICAL_ACTIONS_URL.fullmatch(target) is None
+        for variant in variants
+        for target in _rendered_markdown_link_targets(variant)
+    )
     malformed = malformed or any(
         count > direct_paths[identity]
         for paths in variant_paths[1:]

tests/test_release_documents.py

@@ -708,6 +708,8 @@ def test_release_evidence_rejects_obsolete_workflow_reference_marker(
         "prefix<https://github.com/cometapi-dev/cometapi-python/actions/runs/30515861246>",
         "[evil](mailto:foo](https://github.com/cometapi-dev/cometapi-python/"
         "actions/runs/30515861246))",
+        "[evil](mailto:foo([x](https://github.com/cometapi-dev/cometapi-python/"
+        "actions/runs/30515861246)))",
         "http://github.com/cometapi-dev/cometapi-python/actions/runs/30511373822",
         "https://evil.example/?next=https%3A%2F%2Fgithub.com%2Fcometapi-dev%2F"
         "cometapi-python%2Factions%2Fruns%2F30511373822",