fix: reject composed release URL wrappers

Author: CometAPI

scripts/_checks.py

@@ -683,17 +683,17 @@ def _canonical_actions_run_violations(
     findings: list[tuple[int, str]] = []
     normalized = unicodedata.normalize("NFKC", body)
     direct = normalized
-    markdown_unescaped = re.sub(r"\\([/\\.:?&=%#])", r"\1", normalized)
-    browser_normalized = re.sub(
-        r"(?i)(https?://[^\s<>)\]]*)\\([^\s<>)\]]*)",
-        lambda match: match.group(0).replace("\\", "/"),
-        markdown_unescaped,
-    )
     for _ in range(3):
         decoded = html.unescape(direct)
         if decoded == direct:
             break
         direct = decoded
+    markdown_unescaped = re.sub(r"\\([/\\.:?&=%#])", r"\1", direct)
+    browser_normalized = re.sub(
+        r"(?i)(https?://[^\s<>)\]]*)\\([^\s<>)\]]*)",
+        lambda match: match.group(0).replace("\\", "/"),
+        markdown_unescaped,
+    )
 
     path_matches = list(_ACTIONS_PATH.finditer(direct))
     canonical_matches = list(_CANONICAL_ACTIONS_URL.finditer(direct))

tests/test_release_documents.py

@@ -713,6 +713,7 @@ def test_release_evidence_rejects_obsolete_workflow_reference_marker(
         "https://github.com/cometapi-dev/cometapi-python/actions/runs/30511373822",
         "https://github.com/cometapi-dev/cometapi-python/actions\\/runs\\/30511373822",
         "https://github.com/cometapi-dev/cometapi-python/actions\\runs\\30511373822",
+        "https://github.com/cometapi-dev/cometapi-python\actions\runs\30511373822",
         "https://github.com/cometapi-dev/cometapi-python/actions/runs/30511373822.evil",
         "https://github.com/cometapi-dev/cometapi-python/actions/runs/30511373822/attempts/0",
     ],