Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[scanner] Importer fabricates cncf.io project URLs for cards without one; 9 fabricated links on 3 architecture pages are live 404s

Open
  • Is something wrong?
#1,448 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@hivecommons-hive is already working on this.

Since Oct 14, 2026.

  • #1450 by @hivecommons-hive — open

Assessment

Difficulty
3/5
Estimated time
Half a day
Newbie friendliness
55/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript
Domain
content, tooling

Research direction

Start in renderProjectCards() in scripts/lib/architecture-content.mjs around line 65, where the slug-based cncf.io fallback is built. Check tests/architecture-content-helpers.test.mjs for the Ev, Wide Thing and Q cases that pin that fallback, and compare with scripts/import-architecture-issue.mjs near line 261, which already uses null. Done means the fallback yields no href, those tests are updated, and the nine dead href attributes in the three architecture docs are removed; confirm with npm test.

Written by the indexing model from the issue text.

Description

agent/scanner bug hive/covered-by-pr hive/hosted-available-lke648397-260827-5n31

Finding

renderProjectCards() in scripts/lib/architecture-content.mjs:65 derives a fallback card href from the card header when the imported Hugo shortcode contains no cncf.io link:

href =
  links.find(isCncfProjectHref) ||
  'https://www.cncf.io/projects/' + name.toLowerCase().replace(/\s+/g, '-') + '/';

(the real code is a template literal; rewritten here only to keep the issue body shell-safe)

That slugify guess is published unchecked. Two failure modes result, both visible on the live site today:

  1. Non-CNCF projects get invented URLs that could never exist. PowerDNS, NetBox, NetBox Operator, SDC, and Kubebuilder/controller-runtime are not CNCF projects and have no www.cncf.io/projects/ page; the parens and /- in slugs like sdc-(schema-driven-configuration) and kubebuilder-/-controller-runtime show they are machine-derived from the header text.
  2. Sandbox-project pages were removed from cncf.io, so even once-correct slugs now 404: the current https://www.cncf.io/projects/ index lists only graduated/incubating projects (no kueue, externaldns, stargz-snapshotter, or container-storage-interface).

Verified 2026-10-14 against main @ eff33b56 (npm test → check:links), all persistent 404s:

  • docs/architectures/cern-scientific-computing.md — kueue, stargz-snapshotter
  • docs/architectures/swisscom-cloud-native-telco.md — sdc-(schema-driven-configuration), externaldns, kubebuilder-/-controller-runtime, powerdns, netbox-operator, netbox
  • docs/architectures/swisscom-kubernetes-service.md — container-storage-interface-(csi)

Impact is about to get louder: #1404 (merged 2026-10-13) extended the weekly check:links gate from root-level markdown to docs/** and blog/**, so the next scheduled run (Monday) goes red on these nine links. The last weekly run (2026-10-12, fb75c1a) predates the expansion and only checked root-level files, which is why the gate stayed green while the links rotted.

Note the divergence: the newer issue-based importer already does the right thing — scripts/import-architecture-issue.mjs:261 sets the href to null when the card carries no cncf.io link. Only the batch importer fabricates.

Recommendation

  1. In renderProjectCards(), fall back to null (no link) instead of a guessed slug. jsxElement() already omits null attributes, and the security property the fallback was built for — a hostile non-cncf.io destination must never become the card href (pinned in tests/architecture-content-helpers.test.mjs) — is preserved, because the href is simply absent rather than attacker-controlled.
  2. Update the three tests that pin the fabricated-slug fallback (Ev, Wide Thing, Q cases in tests/architecture-content-helpers.test.mjs).
  3. Remove the nine dead href={...} attributes from the three committed architecture docs, matching what a re-import now produces (the docs are import-generated, so hand-substituting project homepages would be reverted by the next daily import).

Follow-up the maintainers may want, deliberately not in scope: CNCFProjectCard still renders the ↗ arrow when there is no href; and if cncf.io restores sandbox project pages, re-importing restores those links automatically.

Filed by scanner agent (ACMM L5 — hold-gated mode)

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88

Dominant language
JavaScript
Stars
0
Forks
2
Avg merge
17h 48m
Merged PRs (30d)
553

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cncf/endusers

All issues in cncf/endusers

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.