flightcheck: autolink bare URLs in report remediation

[daeunJe0ng]

Summary

FlightCheck report remediation text supports two link forms: markdown [label](url) and bare https://… URLs. Only the markdown form was linkified. Bare URLs were HTML-escaped and rendered as plain text, so they showed up but were not clickable. Because different checks author URLs differently, operators saw links that worked on some rows and not others.

The concrete live case is the WD-CONN connection-health check (checks/workday.py), whose WARNING and FAILED remediations embed a bare make.powerautomate.com/environments/<env>/connections URL built via f-string. That URL is the operator's path to fix a broken Workday connection, and today it renders as non-clickable plain text.

This makes both forms render as clickable anchors.

What changed

• _md_links_to_html (in runner.py) now runs a second pass, _autolink_bare_urls, after the markdown pass.
• The bare-URL pass steps over anchors created by the markdown pass, so [label](url) is never double-wrapped.
• Trailing sentence punctuation (.,;:!?) and an unbalanced closing paren are trimmed off the link target, so see https://aka.ms/x. keeps the period outside the href. Balanced parens are preserved, so .../Foo_(bar) stays intact; only an unbalanced trailing ) (as in (see https://x)) is pushed back into the text. A ; that terminates an HTML entity (&) is not stripped, so query strings stay whole.
• A trailing escaped delimiter entity (<, >, ") is peeled back into the text. An angle-bracket-wrapped URL <https://x> escapes to <https://x>; without this, the trailing > was pulled into the href. An unescaped <, > or " is never a valid URL character, so the wrapping bracket/quote stays as text and only the URL is anchored. A real query-string & is still kept whole.
• _multiline_html and the manual checklist renderer call _md_links_to_html, so they inherit the fix with no separate change.

Design rationale

The fix lives in the renderer, not in each check. That fixes every existing report immediately and means check authors cannot reintroduce a non-clickable link by pasting a raw URL. The alternative (a lint rule forcing markdown links) would leave current reports broken and add an ongoing authoring burden. The renderer is the single choke point every remediation string already passes through, so it is the correct layer.

Testing

• tests/flightcheck/test_runner_link_rendering.py (15 tests): bare URL becomes an anchor, trailing punctuation and unbalanced parens excluded, balanced parens preserved, query-string & stays HTML-safe and a trailing & is not split, angle-bracket-wrapped and quote-wrapped URLs exclude the escaped delimiter, markdown links still work and are not double-wrapped, mixed markdown + bare, plain text untouched except escaping, _multiline_html linkifies and keeps line breaks, plus end-to-end check cards render clickable links.
• Full FlightCheck suite (tests/flightcheck): 1011 passed.

Scope note

This PR makes bare URLs clickable. It does not check that a link's host is real/intended (typo'd or hallucinated domains) — that host-level hygiene gate is #209.

Risks and assumptions

• Change touches shared report rendering, used by every check. Mitigated by the full-suite run and by keeping the markdown behavior identical (verified by the no-double-wrap test).
• Assumes remediation URLs are http/https only. Other schemes are not autolinked, which is intentional for a security-reviewed report surface.
• Not in scope: _mask_sensitive can rewrite a GUID that appears inside a deep-link URL, which alters the link target. That is a separate concern from clickability and is left untouched here.

[apurvabanka]

No code blockers. The only thing gating merge is the required approving review (REVIEW_REQUIRED / BLOCKED) — everything else is ready.

A few non-blocking notes / gaps worth acknowledging:

1. GUID masking inside deep-link URLs (please confirm): _mask_sensitive can rewrite a GUID embedded in a link target, which alters the href. The PR calls this out as out of scope, but the WD-CONN remediation URL this change is meant to fix contains an environment GUID — so a masked link could point somewhere invalid. Can we confirm that's acceptable for the live case, or is it worth a follow-up?

2. Host validation — bare URLs are now clickable but not validated (typo'd/hallucinated domains). Already tracked as flightcheck: offline https link gate + run FlightCheck suite in CI #209, just noting it here.

3. Minor untested edge case: an angle-bracket-wrapped URL like <https://x> escapes to <https://x>, and the regex would pull > into the href. Unlikely in remediation text and low risk — flagging for awareness only.

@daeunJe0ng