fix(site-publish): reject split input symlinks

Authored-By: OpenAI (GPT-5) <noreply@openai.com>

scripts/utils.py

@@ -427,6 +427,8 @@ def normalize_site_config(raw, site_name):
 
 def validate_artifact_inputs(site_dir, cfg):
     """Reject source containment before a public or protected build starts."""
+    if cfg["compatibility"]:
+        return
     root = Path(site_dir).resolve()
     sources = []
     for artifact in cfg["artifacts"]:
@@ -435,6 +437,13 @@ def validate_artifact_inputs(site_dir, cfg):
             raise ConfigError(
                 f"artifact {artifact['name']} content_dir resolves outside the repository"
             )
+        if source.exists():
+            symlink = next((path for path in source.rglob("*") if path.is_symlink()), None)
+            if symlink is not None:
+                raise ConfigError(
+                    f"artifact {artifact['name']} build input contains symlink: "
+                    f"{symlink.relative_to(root)}"
+                )
         sources.append((artifact["name"], source))
     for index, (name, source) in enumerate(sources):
         for other_name, other_source in sources[index + 1:]: