Validate visible rendered provenance

Authored-By: Codex (GPT-5) <noreply@openai.com>

check.sh

@@ -10,6 +10,8 @@ AUTHOR="${PR_AUTHOR:-}"
 BODY="${PR_BODY:-}"
 BASE="${BASE_SHA:-}"
 HEAD="${HEAD_SHA:-}"
+SERVER_URL="${GITEA_SERVER_URL:-}"
+TOKEN="${GITEA_TOKEN:-}"
 
 # Break-glass: dfritz is exempt from all naming checks.
 if [ "${AUTHOR}" = "dfritz" ]; then
@@ -21,16 +23,23 @@ FAILED=0
 BRANCH_KIND="invalid"
 BRANCH_BUG=""
 
-# Gitea hides HTML comments. Reject their delimiters so required provenance is
-# always visible, then parse the raw body without a second Markdown renderer.
-VISIBLE_BODY="${BODY}"
-if printf '%s\n' "${BODY}" | grep -Fq '<!--' ||
-   printf '%s\n' "${BODY}" | grep -Fq -- '-->'; then
-  echo "FAIL[check-naming]: PR body must not contain HTML comment delimiters"
+# Gitea's renderer is the visibility contract. Validate its output instead of
+# maintaining a second Markdown parser in this action.
+RENDERED_BODY=""
+if [ -z "${SERVER_URL}" ] || [ -z "${TOKEN}" ]; then
+  echo "FAIL[check-naming]: server-url and token are required to render the PR body"
+  FAILED=1
+elif ! RENDERED_BODY=$(printf '%s' "${BODY}" |
+  jq -Rs '{Text: ., Mode: "gfm"}' |
+  curl --fail --silent --show-error \
+    --header "Authorization: token ${TOKEN}" \
+    --header "Content-Type: application/json" \
+    --data-binary @- "${SERVER_URL%/}/api/v1/markdown"); then
+  echo "FAIL[check-naming]: Gitea could not render the PR body"
   FAILED=1
 fi
-if printf '%s\n' "${BODY}" | grep -Eq '^[[:blank:]]*(```|~~~)'; then
-  echo "FAIL[check-naming]: PR body must not contain fenced code delimiters"
+if printf '%s\n' "${RENDERED_BODY}" | grep -Eiq '<details([[:space:]>])'; then
+  echo "FAIL[check-naming]: rendered PR body must not contain collapsed details"
   FAILED=1
 fi
 
@@ -72,9 +81,9 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then
     FAILED=1
   fi
 
-  tracking=$(printf '%s\n' "${VISIBLE_BODY}" | awk '
-    /^## Tracking[[:space:]]*$/ { in_section=1; next }
-    /^## / && in_section { exit }
+  tracking=$(printf '%s\n' "${RENDERED_BODY}" | awk '
+    /<h2[^>]*>Tracking<\/h2>/ { in_section=1; next }
+    /<h2[^>]*>/ && in_section { exit }
     in_section { print }
   ')
   if [ -z "${tracking}" ]; then
@@ -97,12 +106,12 @@ elif [ "${BRANCH_KIND}" = "chore" ] && [ -n "${TITLE_BUG}" ]; then
 fi
 
 if [ "${BRANCH_KIND}" != "invalid" ]; then
-  attribution=$(printf '%s\n' "${VISIBLE_BODY}" | awk '
-    /^## Attribution[[:space:]]*$/ { in_section=1; next }
-    /^## / && in_section { exit }
+  attribution=$(printf '%s\n' "${RENDERED_BODY}" | awk '
+    /<h2[^>]*>Attribution<\/h2>/ { in_section=1; next }
+    /<h2[^>]*>/ && in_section { exit }
     in_section { print }
   ')
-  watermark_re='^[-*]?[[:space:]]*Authored-By: .+ \(.+\) <noreply@[[:alnum:].-]+>$'
+  watermark_re='Authored-By: .+ \(.+\) <a href="mailto:noreply@[[:alnum:].-]+"[^>]*>noreply@[[:alnum:].-]+</a>'
   if ! printf '%s\n' "${attribution}" | grep -qE "${watermark_re}"; then
     echo "FAIL[check-naming]: ## Attribution must contain an Authored-By product/model watermark"
     FAILED=1