[estcarisimo]

Summary

Site fixes, found by the new link checker

• The LaNet-vi documentation link was 404 on the live EN and FR Software pages. https://conexdat.github.io/LaNet-vi/ is another repository's site on the same domain, so polyglot rewrote it to /en/LaNet-vi/. The path is now excluded from localization, and AGENTS.md documents the pitfall.
• Icons: five icon files the pages referenced never existed, and on EN/FR pages the favicon.ico link got an /en/ prefix. The icons are now generated from the group logo, using the network drawing with thickened strokes at small sizes, and a web manifest is added. images/ is excluded from localization.
• People photos are resolved at build time by a small plugin that lists images/people/. The People page no longer makes about 35 failing image requests per visit.
• About 15 dead links repaired:
  • IETF drafts now point to Datatracker.
  • Two JAIIO papers point to the new sadio.org.ar URLs; each PDF was opened and checked to be the right paper.
  • The elections site, the E-Technology journal issue and the NetSci-X 2019 program point to verified Wayback snapshots.
  • One collaborator homepage was replaced.
  • Four URLs with no surviving copy were removed; their entries remain.

Workflows and repository

• Every action is pinned to a full commit SHA, uses persist-credentials: false, and gets per-job permissions. zizmor is clean.
• Build site now also checks internal links offline, and the topic-id check fails when it finds no tags (the round-4 finding on Publication topics, AGENTS.md, American English; no contact e-mail #4).
• New security.yml runs bundler-audit on Gemfile.lock and zizmor on the workflows, on changes and weekly. It already caught vulnerable concurrent-ruby and json, both patched here.
• New link-check.yml checks every link weekly. It opens a single broken-link issue, updates it, and closes it when the links pass again.
• Gemfile.lock is now committed, so builds are reproducible.
• Dependabot runs weekly with grouped updates and a 7-day cooldown.
• Other additions:
  • pre-commit hooks
  • .editorconfig
  • CODEOWNERS
  • .github/REVIEW.md, a reviewer brief modeled on jitterbug
• Already applied through the API: secret scanning with push protection, CodeQL default setup, a read-only default GITHUB_TOKEN, and the labels content, broken-link and security.

Verification

• The production build passes, as do all build.yml steps run locally: topic ids (87 tagged, 18 ids) and sanity (309 HTML files).
• Internal links have 0 errors; a deliberately broken link is caught.
• bundle-audit is clean, pre-commit run --all-files passes, and zizmor reports no findings.
• The online link check has no errors left except the new icon files, which exist once this deploys.

🤖 Generated with Claude Code

[estcarisimo]

Review round 1 (commit 44e85b5), fresh Sonnet reviewer following .github/REVIEW.md

VERDICT: CHANGES REQUESTED. Checks: build pass, CI steps pass, internal links 0 errors, pre-commit pass, zizmor pass.

Findings

1. [should-fix] CONTRIBUTING.md:88. The code fence closes as "``` The dev config is", which is not a valid closing fence. The warning paragraph, the "Pull-request checklist" heading and the checklist all render inside one code block. Fix: put the closing fence on its own line and restore the sentence.
2. [nit] link-check.yml:68. The issue body is the whole lychee report. GitHub caps issue bodies at 65,536 characters, and a systemic failure could exceed that, so no issue would be opened. Fix: truncate the report and link to the run.
3. [nit] security.yml:56. uvx zizmor is unpinned, so a new zizmor rule can turn unrelated PRs red. The pre-commit hook pins v1.30.1. Fix: pin it.

Verified claims:

• Pins: all five SHA pins match their tags.
• Permissions: they are minimal, and the job-level grants are present with the read-only default token.
• Link-check issue step: it is correct in all four cases.
• Lockfile: Gemfile.lock installs on x86_64-linux-gnu, and bundle-audit is clean.
• Localization: there are no /en/images or /en/LaNet-vi links left, and the UBACyT link localizes correctly.
• People photos: each People page renders 4 photos and 34 placeholders, with no requests for missing files.
• Changed URLs: every one returns 200 with the intended content. The Wayback snapshots and the JAIIO PDFs were checked page by page.
• Icons and manifest: both are valid.
• Online link check: its only errors are the icon URLs, which are not deployed yet.

[estcarisimo]

Review round 2 (commit db33091), fresh Sonnet reviewer following .github/REVIEW.md

VERDICT: APPROVE. Checks: build pass, CI steps pass, internal links 0 errors (2961 total), pre-commit pass, zizmor pass.

Earlier rounds

• Round 1, finding 1 (CONTRIBUTING fence): fixed in db33091. The fences are balanced (6), and the checklist heading renders outside any code block.
• Round 1, finding 2 (issue-body size): fixed in db33091. The step was run with a stub gh on reports of 30,000, 59,900, 60,000, 60,001 and 90,000 bytes, including multibyte text. The truncated body stays under 65,536 bytes in every case and is valid UTF-8.
• Round 1, finding 3 (unpinned zizmor): fixed in db33091. It now runs as zizmor@1.30.1, matching the pre-commit hook, and reports no findings.

Verified again:

• Links: every changed URL returns 200 with the intended content.
• Pins: all five SHA pins match their tags.
• Credentials and permissions: persist-credentials: false is set everywhere, permissions are least-privilege, and no untrusted input reaches run:.
• Repository settings: CodeQL, secret scanning and push protection are on (checked through the API), and the broken-link label exists.
• Localization and content: the UBACyT link localizes correctly. The PR adds no e-mail addresses, no cnet.fi.uba.ar links and no British spellings.

Non-blocking note: head -c 60000 can cut the report mid-line. The full report stays in the job summary.