fix(queue-health): enforce canonical repository identity

scripts/ci/actions_queue_health_core.py

@@ -60,7 +60,7 @@ def _repository_name(value: Any) -> str:
     """Validate and return one owner/repository identifier."""
     if not isinstance(value, str) or not REPOSITORY_PATTERN.fullmatch(value):
         raise QueueHealthError(f"invalid repository identifier: {value!r}")
-    if any(segment in {".", ".."} for segment in value.split("/")):
+    if any(".." in segment or segment.endswith(".") for segment in value.split("/")):
         raise QueueHealthError(f"invalid repository identifier: {value!r}")
     return value
 

tests/test_actions_queue_health_repository_identity.py

@@ -0,0 +1,62 @@
+"""Regression coverage for queue-health repository identity admission."""
+
+import importlib.util
+import json
+from pathlib import Path
+
+import pytest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+MODULE_PATH = ROOT / "scripts/ci/actions_queue_health_core.py"
+SPEC = importlib.util.spec_from_file_location("actions_queue_health_core_identity", MODULE_PATH)
+assert SPEC and SPEC.loader
+queue_health = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(queue_health)
+
+
+@pytest.mark.parametrize(
+    "repository",
+    [
+        "ContextualWisdomLab/repository.",
+        "ContextualWisdomLab/repo..name",
+        "ContextualWisdomLab./repository",
+        "Contextual..WisdomLab/repository",
+        "ContextualWisdomLab/..",
+        "ContextualWisdomLab/.",
+    ],
+)
+def test_load_allowlist_rejects_noncanonical_repository_identity(
+    tmp_path: Path, repository: str
+) -> None:
+    """Reject non-canonical repository components through the production allowlist path."""
+    allowlist = tmp_path / "repositories.json"
+    allowlist.write_text(
+        json.dumps({"repositories": [repository]}),
+        encoding="utf-8",
+    )
+
+    with pytest.raises(queue_health.QueueHealthError, match="invalid repository identifier"):
+        queue_health.load_allowlist(allowlist)
+
+
+@pytest.mark.parametrize(
+    "repository",
+    [
+        "ContextualWisdomLab/.github",
+        "ContextualWisdomLab/repository.name",
+        "ContextualWisdomLab/repository_name",
+        "ContextualWisdomLab/repository-name",
+    ],
+)
+def test_load_allowlist_preserves_canonical_repository_identity(
+    tmp_path: Path, repository: str
+) -> None:
+    """Keep valid dot-prefixed and punctuation-bearing repository names admissible."""
+    allowlist = tmp_path / "repositories.json"
+    allowlist.write_text(
+        json.dumps({"repositories": [repository]}),
+        encoding="utf-8",
+    )
+
+    assert queue_health.load_allowlist(allowlist) == [repository]