[Copilot]

The Validate catalog / Link check (changed files) job was failing on pre-existing dead links in public/tools/social-media-intelligence.md, even when a PR only introduced a new entry. This change narrows PR-time link validation to links actually added/modified by the PR diff.

• Workflow behavior change (PR path)

  • In .github/workflows/validate-catalog.yml, replaced file-level targeting with diff-entry targeting in links-changed.
  • The workflow now computes added/modified catalog entry lines from:
    • git diff --unified=0 --diff-filter=d "$base" "$head" -- 'public/tools/*.md'
  • It writes matching entry lines to a temp file and runs scripts/validate-links.js against that file.

• No change to full sweep semantics

  • links-full (scheduled/manual full catalog check) remains unchanged and still validates all links repository-wide.

• Example of new extraction logic

  git diff --unified=0 --diff-filter=d "$base" "$head" -- 'public/tools/*.md' \
    | awk '
        /^\+[^+]/ {
          line = substr($0, 2)
          if (line ~ /^- \*\*.*\*\* - https?:\/\/[^[:space:]]+/) print line
        }
      ' > "$entries_file"

[cloudflare-workers-and-pages]

Deploying osintelligence with    Cloudflare Pages

Latest commit:	e42f157
Status:	✅  Deploy successful!
Preview URL:	https://bc085c6a.osintelligence.pages.dev
Branch Preview URL:	https://copilot-fix-link-check-error.osintelligence.pages.dev

View logs

[atiilla]

Good catch, and the fix is right. Scoping link validation to changed files rather than changed entries was a design flaw in the original workflow: adding a single entry to social-media-intelligence.md pulled all 256 of its URLs into the check, so a contributor got blocked by rot they had nothing to do with. #43 is a live example — one new entry, 258 URLs validated, 12 dead and 4 parked, all pre-existing.

Verified the extraction against #43's real diff: it yields exactly one line, the new entry, and that URL passes. Also confirmed validate-links.js handles the temp file correctly — it parses bare entry lines with no ## heading, and the .md suffix on $RUNNER_TEMP/changed-catalog-links.md matters, since the script filters argv on that extension. Keeping links-full untouched is the right call; rot still gets caught weekly.

Two follow-ups for me rather than you, neither blocking:

Failures now report the temp path (/home/runner/_temp/changed-catalog-links.md:3) instead of the originating catalog file and line, which is worse to act on. Worth having the script carry the real source location through.

Separately, while testing this I found a bug in validate-links.js itself: probe() inspects err.message, which undici always sets to "fetch failed", while the real code sits in err.cause.code. So DNS failures — dead domains, exactly what this check is for — are classified other and don't fail CI. The 12 "DEAD" in the #43 run were HTTP 404/410 only. I'll fix that separately; it makes the check weaker than intended but doesn't affect the correctness of this change.

Merging.