Add coverage to the pre-scan, route confidential issues, fix docs-lint

Andrew Dunnrequested to merge
fold/prescan-and-confidential into main

Closes #3 (closed)

This adds two steps to the contribution walk and fixes one docs-lint.sh defect.

Coverage in the pre-scan

On gitlab-org/gitlab, rspec:undercoverage may fail until an MR has all its approvals, and blocks after that. An uncovered branch passes review and then fails the approved pipeline, as a guard on a keyword argument that no caller omits did. The push that fixes it can reset the approvals. The pre-scan in contribute.md now runs the target's own coverage check, with the method in monorepo.md. environment.md covers the dev-base Gitaly failure behind 0 examples.

flowchart LR
  A[git apply the MR patches onto the default branch] --> B[Changed specs with coverage on the dev base]
  B -->|0 examples| X[Abort, fix the dev base]
  B --> C[Repository undercoverage script against the merge base]
  C -->|no coverage file or no result line| Y[Cannot run, not a pass]
  C -->|uncovered changed line or branch| D[Finding, add the spec or delete the branch]
  C -->|no missing coverage| E[Request review]

The MR is staged by patch because a whole-file overlay reverts every line the default branch added since the MR branched. The result line decides because the check exits 0 when it finds no coverage file.

Routing a confidential issue

filing.md routes a confidential issue to Product Security, through ~security plus ~"bug::vulnerability" or a mention of the PSIRT group. Without one, nobody rules on whether it stays confidential or whether its fix can be public. Two handbook pages give a PSIRT group path that does not resolve, so the section names the live one.

docs-lint.sh with no pin file

When a target pins neither linter, docs-lint.sh left the 404 body in its work directory as mise.toml, and a markdownlint-cli2 installed as a mise shim read it as config and linted no files. An optional 404 now keeps no body, and the target's pins are read from a name mise ignores.

Verified: just ci passes (127 tests, shellcheck clean), and the new no-pin-file assertion fails against the old script. A real mise shim fails the same way the stub does.

AI-Generated Content Disclosure: This MR was prepared with assistance from Claude Code and verified by running just ci.

Merge request reports