Skip to content

feat(markdown): Markdown (GFM) static-analysis module - #2

Merged
kyle-sexton merged 1 commit into
mainfrom
feat/markdown-module
Jun 22, 2026
Merged

feat(markdown): Markdown (GFM) static-analysis module#2
kyle-sexton merged 1 commit into
mainfrom
feat/markdown-module

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

What

Second standards module: GitHub Flavored Markdown linting via markdownlint-cli2.

  • modules/markdown/.markdownlint-cli2.jsonc — the GFM ruleset (schema-pinned to cli2 0.22.1)
  • package.json + package-lock.json — markdownlint-cli2@0.22.1 pinned devDependency; .node-version pins Node 24.17.0 (provided by fnm)
  • fixtures/markdown/{good,bad} + modules/markdown/markdown.test.sh (shell harness)
  • .github/workflows/markdown.yml — setup-node from .node-version, npm ci, self-lint + fixtures test
  • ignore node_modules/

The repo lints its own markdown using the module config via --config (no root copy), excluding the intentionally-bad fixtures with a !-negated glob.

Verification (local — Node 24.17.0, markdownlint-cli2 0.22.1)

  • good fixture clean (exit 0); bad fixture 9 findings (exit 1)
  • repo self-lint clean across 7 markdown files
  • harness 3/3 (lib + powershell + markdown); shellcheck -x + actionlint clean

🤖 Generated with Claude Code

@kyle-sexton @claude
feat(markdown): add Markdown (GFM) static-analysis module
51ec772 
Second standards module. modules/markdown/.markdownlint-cli2.jsonc is the
GFM ruleset (ATX headings, dash bullets, asterisk emphasis, backtick
fences, GFM table rules), schema-pinned to markdownlint-cli2 0.22.1.
markdownlint-cli2 is pinned as an npm devDependency; Node is pinned via
.node-version (24.17.0, provided by fnm). The repo lints its own markdown
with the module config via --config (no root copy), excluding the
intentionally-bad fixtures with a negated glob.

- good/bad fixtures + markdown.test.sh on the shell harness
- markdown.yml CI: setup-node from .node-version, npm ci, lint + fixtures
- ignore node_modules/

Verified: good fixture clean, bad fixture 9 findings, repo self-lint clean
across 7 files; harness 3/3; shellcheck -x + actionlint clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@kyle-sexton
kyle-sexton merged commit ac2b65a into main Jun 22, 2026
7 checks passed
@kyle-sexton
kyle-sexton deleted the feat/markdown-module branch June 22, 2026 14:29
@claude claude Bot mentioned this pull request Jul 7, 2026
Merged
This was referenced Jul 16, 2026
Merged
Merged
Merged
Merged
Merged
kyle-sexton pushed a commit that referenced this pull request Jul 23, 2026
@dependabot
build(deps): Bump fast-uri from 3.1.3 to 3.1.4 in /components/concurr…
2234b41 
…ency-policy (#239)

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to
3.1.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fastify/fast-uri/releases">fast-uri's
releases</a>.</em></p>
<blockquote>
<h2>v3.1.4</h2>
<h2>⚠️ Security Release</h2>
<p>Fix for <a
href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx">https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx</a></p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4">https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fastify/fast-uri/commit/6aeece669e4166b2446a89f17c07a3b15dfb7ed4"><code>6aeece6</code></a>
Bumped v3.1.4</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353"><code>2d50fba</code></a>
fix: reject literal backslash in URI authority</li>
<li>See full diff in <a
href="https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fast-uri&package-manager=npm_and_yarn&previous-version=3.1.3&new-version=3.1.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/melodic-software/standards/network/alerts).

</details>

## Related

- Resolves [Dependabot alert
#2](https://github.com/melodic-software/standards/security/dependabot/2)
(fast-uri host confusion, GHSA-v2hh-gcrm-f6hx) in
`components/concurrency-policy`.

No linked issue.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Jul 23, 2026
Closed
Merged
kyle-sexton added a commit that referenced this pull request Jul 23, 2026
@kyle-sexton
docs(dependabot-policy): document the security-update absorb path for…
dc1729c 
… sync-managed materializations (#258)

No related issue: documentation-only absorb-path note; the open decision
remains tracked on #256

## Summary

- Documents the security-update absorb path for sync-managed
materializations in `components/dependabot-policy/README.md`: Dependabot
security-update jobs cannot fix a dependency inside a managed
materialization (e.g.
`.github/standards/<component>/package-lock.json`); the fix arrives via
upstream-bump-then-sync instead, and a maintainer should expect and
ignore doomed security-update job failures against a managed manifest
until the sync PR lands.
- Evidence: github-iac fast-uri Dependabot alert #2, 2026-07-22/23 (see
standards#256).
- Option A only (document and accept the noise). Option B (suppressing
the jobs via Dependabot scoping) stays open and undecided — pointer to
#256, no restatement of its body.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Related

#256
@claude claude Bot mentioned this pull request Jul 25, 2026
Merged
@kyle-sexton kyle-sexton mentioned this pull request Jul 27, 2026
Closed
@claude claude Bot mentioned this pull request Aug 11, 2026
Merged
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kyle-sexton