The GitHub Actions job "prek" on airflow-steward.git/main has succeeded. Run started by GitHub user potiuk (triggered by potiuk).
Head commit for run: fe71a0f3cada16d3e904ec8a835a5b0d6805561a / Jarek Potiuk <[email protected]> chore(ci): run lychee link-check offline; drop dead sandbox network domains (#501) * chore(ci): run lychee link-check offline; drop dead sandbox network domains The `lychee` prek hook links macOS SecureTransport (`native-tls`), whose TLS handshake fails through the secure-agent sandbox's CONNECT proxy on macOS 26 (`OSStatus -26276`) even though the certs are valid, there is no MITM, and trustd is reachable — so online external-link checking cannot pass in-sandbox. `enableWeakerNetworkIsolation` no longer rescues it on this OS. Switch the hook to offline mode (`offline = true` in `.lychee.toml`): it now validates only local cross-file and anchor references, which is the in-repo reference integrity this hook is really for. External-URL liveness was flaky and rate-limited anyway (hence the long ASF-infra `exclude` list) and is no longer checked anywhere. With external link-checking gone, the wildcard link-target domains that were allowlisted purely so lychee could reach them (`*.apache.org`, `*.anthropic.com`, `*.claude.com`, `*.mitre.org`, `*.nist.gov`, `*.github.io`, `gist.github.com`, `astral.sh`, `json.schemastore.org`, `lychee.cli.rs`, `sdkman.io`) are dead weight — drop them from the sandbox allowlist. Kept: `*.crates.io` + `static.rust-lang.org` (still needed to build lychee) and `enableWeakerNetworkIsolation` (gh / gcloud / Go-tool TLS, per the schema). - .lychee.toml: offline = true; header rewritten to local-references-only - .claude/settings.json: drop the 11 dead lychee link-target domains - docs/setup/secure-agent-setup.md (isolation-setup template): same domain removal; add ~/.rustup + ~/.cargo write/read and static.rust-lang.org so a fresh in-sandbox setup can actually build lychee's toolchain; replace the excludedCommands/TLS workaround note with an offline-mode explanation Generated-by: Claude Code (Opus 4.8) * fix(sandbox-lint): drop the dead lychee domains from the baseline too The sandbox-lint M.29 invariant requires `.claude/settings.json` and `tools/sandbox-lint/expected.json` to stay in lockstep (two files, two edits, one review surface). The prior commit removed the 11 dead lychee link-target domains from the live settings but not the baseline, so the `sandbox-lint` CLI and its `test_baseline_file_matches_live_settings` / `test_main_exits_zero_on_repo` tests failed in CI. Mirror the same removal in expected.json. Generated-by: Claude Code (Opus 4.8) Report URL: https://github.com/apache/airflow-steward/actions/runs/27378919534 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
