Build the Prose Gate's HTML Span Without Slicing markdown-it-py's Pattern, and Pin It Exactly - #4035

Summary

The prose gate crashed on import under markdown-it-py 4.3.0, so every open pull request's Lint and Python unit-test jobs failed. In 4.2.0, markdown_it.common.html_re.HTML_TAG_RE.pattern opens with ^. In 4.3.0 it opens directly with its non-capturing group. MARKDOWN_SPAN was built from HTML_TAG_RE.pattern[1:]. Under 4.3.0 that slice cut the group's opening parenthesis, and the compile raised re.PatternError: nothing to repeat.

• .github/actions/prose-gate/prose_lint.py:
  • The span is now built by markdown_span(), which drops a leading ^ only where one is present. The tag alternative is therefore the same under 4.2.0 and 4.3.0. The rest of the upstream pattern is unchanged between the two releases.
  • The inline dependency is pinned exactly, markdown-it-py==4.3.0.
• scripts/backlog_metrics.py takes Pin backlog_metrics.py's Inline Dependency So a Token-Holding Run Resolves a Reviewed Version #3935's first done-when option. It pins markdown-it-py==4.3.0 exactly, and also mdurl==0.1.2, the one package that version requires. A run holding a gh token then imports only versions this pull request reviewed. The usage header says that running it with --script, as its documented command already does, is what makes uv read those pins. It also says what a bump has to move.
• tests/requirements.txt takes the same exact markdown-it-py version, so the suite runs the version the two pinned scripts run.
• tests/test_prose_lint.py checks a constructed tag pattern in both shapes, anchored and unanchored. It asserts that the old one-character slice fails to compile on the unanchored shape, and that markdown_span() masks the same spans from either shape.
• tests/test_backlog_metrics.py adds PinTests:
  • The markdown-it-py pin must be exact and equal across the prose gate, backlog_metrics.py, and tests/requirements.txt.
  • Every dependency backlog_metrics.py declares must be exact.
  • Each package the installed, pinned markdown-it-py requires must be among those exact pins.

Verification

• On import under markdown-it-py 4.3.0, the develop copy of prose_lint.py raises re.PatternError: nothing to repeat.
• test_prose_lint and test_backlog_metrics pass under 4.2.0 and under 4.3.0.
• The full unit-test suite passes under tests/requirements.txt: 3770 tests, 11 skipped.
• Each PinTests case fails when its condition is broken. A tests/requirements.txt pin that differs from the other two fails the first case. Dropping mdurl from backlog_metrics.py fails the last.
• uv run --no-project --script scripts/backlog_metrics.py --help resolves the pins and runs.
• scripts/prose_lint.py --diff against develop reports nothing.

Open introduced findings

• tests/test_backlog_metrics.py, PinTests.test_every_package_the_token_holding_run_resolves_is_pinned_exactly (class introduced): the test reads the requirements of markdown-it-py alone, one level down. It does not read the requirements of the other exact pins. So a future mdurl release that declares a requirement, followed by a bump of the mdurl== pin, would leave that new package unpinned with the test still green. The local pass's edit budget ran out on this one, so this pull request's review loop decides its outcome.
  • Outcome: declined. mdurl 0.1.2 declares no requirements, so no package goes unpinned today. The gap opens only if two things happen: a later mdurl release adds a requirement, and its pin is then bumped. That bump is a reviewed one-line change, and the docstring tells whoever makes it to pin what the new version requires. The suggested check also could not measure the pin as written. tests/requirements.txt does not pin mdurl, so the suite's installed mdurl is whichever 0.1.x uv resolves, not the backlog_metrics.py pin. Making that check measure the pin would mean a fourth stated pin with an equality test of its own. That adds complexity for a case no current release produces.

Declined review output

• CodeRabbit's "Docstring Coverage" pre-merge check (class style, on tests/test_backlog_metrics.py PinTests), declined. No repository rule requires a docstring on every function. The Python code-style reference allows a one-liner, or none, on a trivial helper or a test with a self-documenting name. This file's existing helpers, issue and metrics, carry none. Each PinTests case's contract is in its name and its class docstring.

Closes on promotion: #4033, #3935

🤖 Generated with Claude Code