Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[architect] project-card-links.mjs inlines its own cncf.io host allow-list, missed by the CNCF_HOST_SUFFIXES consolidation

Closed
  • Is something wrong?
#1,446 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

A pull request for this has already been merged.

  • #1443 by @hivecommons-hive — merged

Assessment

Difficulty
2/5
Estimated time
Under an hour
Newbie friendliness
25/100
Issue type
Refactor
Clarity
Mostly clear
Activity status
Active
Tech stack
javascript
Domain
tooling

Research direction

The inline allow-list is in isCncfProjectHref() in scripts/lib/project-card-links.mjs, which calls isSafeUrl with allowedHostSuffixes: ['cncf.io']. Do not start until PR #1443 merges, since the CNCF_HOST_SUFFIXES export it adds to scripts/lib/url-safety.mjs does not exist yet. Once it does, import that constant in place of the literal; done means no inline cncf.io list remains and the import scripts still pass their checks.

Written by the indexing model from the issue text.

Description

agent/architect architecture hive/hosted-available-lke648397-260827-5n31 tech-debt

Architecture Finding

Type: tech-debt / coupling
Affected area: scripts/lib/project-card-links.mjs

Open PR #1443 centralizes the ['cncf.io'] host allow-list that validator
scripts (validate-case-studies.mjs, validate-metrics.mjs,
validate-radar-reports.mjs) each carried as an independent copy, exporting
it as CNCF_HOST_SUFFIXES from scripts/lib/url-safety.mjs.

scripts/lib/project-card-links.mjs has its own, fourth copy of the same
allow-list that #1443's file list does not touch:

const url = isSafeUrl(value, { allowedHostSuffixes: ['cncf.io'] });

(isCncfProjectHref(), used by both import-architectures.mjs and
import-architecture-issue.mjs to gate project-card links imported from
cncf/architecture.)

Impact

Once #1443 merges, this becomes the one remaining inline copy of the
allow-list: a future change to CNCF's accepted hosts (e.g. adding a second
domain) would need to be applied here independently, with nothing left to
catch the drift — the exact problem #1443's description cites as the reason
to centralize in the first place.

Recommendation

After #1443 merges, import CNCF_HOST_SUFFIXES from
scripts/lib/url-safety.mjs (or the validate-utils.mjs re-export) in
project-card-links.mjs instead of the inline literal, so there is exactly
one allow-list in the codebase.

This is filed as a follow-up rather than a PR because it depends on
CNCF_HOST_SUFFIXES existing, which #1443 introduces and has not yet merged.

Refs #1443 (tracks the consolidation #1443 doesn't cover; apply after #1443 lands)

Filed by architect agent (ACMM L5 — hold-gated mode)

🐝 Hive Agent: architect | Instance: hosted-available-lke648397-260827-5n31 | SHA: eff33b5

— hive: agent=architect backend=copilot model=claude-opus-4-6 copilot=1.0.88

Dominant language
JavaScript
Stars
0
Forks
2
Avg merge
16h 38m
Merged PRs (30d)
608

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cncf/endusers

All issues in cncf/endusers

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.