fix: bind canonical Markdown workflow targets

Author: CometAPI

scripts/_checks.py

@@ -166,6 +166,10 @@ def _actions_path_has_canonical_url(
     if canonical is None:
         return False
 
+    for link in _MARKDOWN_LINK.finditer(text):
+        if link.start("target") <= path.start() and path.end() <= link.end("target"):
+            return _CANONICAL_ACTIONS_URL.fullmatch(link.group("target")) is not None
+
     for attribute in _RAW_HTML_URL_ATTRIBUTE.finditer(text):
         if attribute.start("url") <= path.start() and path.end() <= attribute.end("url"):
             return _CANONICAL_ACTIONS_URL.fullmatch(attribute.group("url")) is not None
@@ -186,10 +190,7 @@ def _actions_path_has_canonical_url(
     if boundary == "<":
         return canonical.start() >= 2 and text[canonical.start() - 2].isspace()
     if boundary == "(":
-        before_boundary = canonical.start() - 2
-        return (
-            before_boundary < 0 or text[before_boundary].isspace() or text[before_boundary] == "]"
-        )
+        return canonical.start() == 1 or text[canonical.start() - 2].isspace()
     return False
 
 

tests/test_release_documents.py

@@ -706,6 +706,8 @@ def test_release_evidence_rejects_obsolete_workflow_reference_marker(
         "actions/runs/30515861246)",
         "mailto:(https://github.com/cometapi-dev/cometapi-python/actions/runs/30515861246)",
         "prefix<https://github.com/cometapi-dev/cometapi-python/actions/runs/30515861246>",
+        "[evil](mailto:foo](https://github.com/cometapi-dev/cometapi-python/"
+        "actions/runs/30515861246))",
         "http://github.com/cometapi-dev/cometapi-python/actions/runs/30511373822",
         "https://evil.example/?next=https%3A%2F%2Fgithub.com%2Fcometapi-dev%2F"
         "cometapi-python%2Factions%2Fruns%2F30511373822",
@@ -777,6 +779,29 @@ def test_release_evidence_accepts_canonical_raw_html_anchor(
     require_public_preview_docs()
 
 
+def test_release_evidence_accepts_canonical_markdown_link(
+    releasable_documents: Path,
+) -> None:
+    evidence = _release_evidence_block().replace(
+        "- Release workflow https://github.com/cometapi-dev/cometapi-python/actions/runs/"
+        "30515861246",
+        "- Release workflow [canonical publication run](https://github.com/"
+        "cometapi-dev/cometapi-python/actions/runs/30515861246)",
+        1,
+    )
+    for name in ("ROADMAP.md", "RELEASING.md"):
+        with (releasable_documents / name).open("a", encoding="utf-8") as stream:
+            stream.write(evidence)
+    _replace(
+        releasable_documents,
+        "CHANGELOG.md",
+        "# Changelog\n",
+        "# Changelog\n\n## [0.1.2] - 2026-07-30\n\nHistory.\n",
+    )
+
+    require_public_preview_docs()
+
+
 def test_fenced_release_evidence_is_not_accepted_as_history(
     releasable_documents: Path,
 ) -> None: