[mrbobbytables]

Test Improvement

Consolidates #1375 into the integrity test #1383 landed, so data/kubecon-na-2026-end-user-talks.json has one contract file instead of two. Supersedes #1375.

Appended to tests/end-user-talks-data.test.mjs:

• sourceUrl and every talk.url must be https, carry no userinfo, resolve to events.linuxfoundation.org, and stay on the schedule page's pathname; apiUrl must resolve to sessionize.com.
• A non-vacuity test that each hostile form (http, javascript:, userinfo, look-alike suffix host, unrelated host, relative path) is rejected.

Uses checkUrl() from scripts/lib/validate-utils.mjs (#1381) rather than the local publishableUrl() copy in #1375, so this does not add a seventh instance of the pattern #1388 tracks. The assertions #1375 also carried for generatedAt validity and day.id slug/uniqueness were already covered by #1383 and are not duplicated.

Verification

• Mutating one committed talk.url to https://events.linuxfoundation.org@evil.example/... fails the suite (1 fail); restored file passes 16/16.
• npm run test:unit:coverage:check: 2565 pass, coverage gate green.

Closes #1374

[hivecommons-hive]

Verified against the tree and ran the test file on this head (node --test tests/end-user-talks-data.test.mjs): all pass.

• checkUrl() in scripts/lib/validate-utils.mjs does what these assertions rely on: protocol allow-list defaults to https (line 79), userinfo rejection at line 118, and the host-suffix check (lines 127-131) uses host === domain || host.endsWith('.' + domain), so the look-alike case events.linuxfoundation.org.evil.example in the non-vacuity test is genuinely rejected, not coincidentally.
• The pathname pin (new URL(talk.url).pathname === new URL(schedule.sourceUrl).pathname) closes the "elsewhere on the real host" gap the comment names, which host checking alone would miss.
• The non-vacuity test is the right guard here: without it, an empty talks array or a silently-permissive checkUrl option change would leave the loops green while asserting nothing.
• Body matches the diff: this is exactly the #1375 scope reimplemented on the shared checkUrl() rather than a local copy, appended to the file #1383 created.

One note for the maintainer: the body says this supersedes #1375 — if that PR is still open, it should be closed in favour of this one when this merges. Looks correct to me.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

Independently verified at pull/1406/head (fork — comment only, no push access).

• node --test tests/end-user-talks-data.test.mjs → 16 pass, 0 fail, matching the body's claim.
• Non-vacuity checked by mutation rather than by reading: re-pointing the first talk.url to https://events.linuxfoundation.org@evil.example/kubecon-cloudnativecon-north-america/program/schedule/ turns the suite red (15 pass, 1 fail) on every talk link is a deep link into the official schedule page. The userinfo-disguised host is genuinely caught, not merely asserted.

Reusing checkUrl() from scripts/lib/validate-utils.mjs rather than re-copying publishableUrl() is the right call — it keeps this consistent with the validate-metrics / validate-case-studies / validate-radar-reports feeds and avoids adding another instance of the pattern #1388 tracks.

One adjacent note, filed separately as #1412 and not a change request on this PR: the e2e-coverage job is the only place 32 of the suite's 309 e2e tests run, and it uploads no Playwright traces, so a flake in that set leaves no evidence. Unrelated to this diff — flagging only so it is not mistaken for something this PR should have covered.

No concerns with the change as it stands.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 1e37cdc

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88