fix: address PR #90 review comments

- workflows/a11y.yml, responsive.yaml: add permissions: contents: read
  (GitHub Advanced Security — GITHUB_TOKEN least-privilege)
- .vscode/settings.json: remove chat.tools.terminal.autoApprove
  (security footgun — keep in local user settings only)
- src/output.ts + output.test.ts: replace Markdown link syntax in <summary>
  with <a href> HTML (GFM does not render [text](url) inside HTML blocks)
- ComparisonTable.vue: remove target=_blank / rel / ext-link SVG icon from
  internal doc links; also remove orphaned .ct-ext-icon CSS rules
- scripts/responsive.pw.ts: only skip position:fixed in overflow detection;
  VitePress nav elements (.VPNav/.VPNavBar/.VPLocalNav/.VPFlyout) are now
  whitelisted by class instead of blanket-skipping all sticky elements —
  fixes potential false negatives for non-nav sticky content

Author: shouze

.github/workflows/a11y.yml

@@ -43,6 +43,9 @@ concurrency:
   group: a11y-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   audit:
     name: WCAG 2.1 AA pages audit

.vscode/settings.json

@@ -1,8 +1 @@
-{
-  "chat.tools.terminal.autoApprove": {
-    "/^git checkout -b feat/promotion-polish && git add -A && git diff --cached --stat$/": {
-      "approve": true,
-      "matchCommandLine": true
-    }
-  }
-}
+{}

docs/.vitepress/theme/ComparisonTable.vue

@@ -108,31 +108,8 @@ const ROWS: Row[] = [
         <tbody>
           <tr v-for="row in ROWS" :key="row.feature" class="ct-row">
             <td class="ct-feature">
-              <a
-                v-if="row.docLink"
-                :href="row.docLink"
-                target="_blank"
-                rel="noopener noreferrer"
-                class="ct-feature-link"
-              >
-                <span class="ct-feature-title">
-                  {{ row.feature }}
-                  <svg
-                    class="ct-ext-icon"
-                    aria-hidden="true"
-                    width="11"
-                    height="11"
-                    viewBox="0 0 24 24"
-                    fill="none"
-                    stroke="currentColor"
-                    stroke-width="2"
-                    stroke-linecap="round"
-                    stroke-linejoin="round"
-                  >
-                    <line x1="7" y1="17" x2="17" y2="7" />
-                    <polyline points="7 7 17 7 17 17" />
-                  </svg>
-                </span>
+              <a v-if="row.docLink" :href="row.docLink" class="ct-feature-link">
+                <span class="ct-feature-title">{{ row.feature }}</span>
                 <span class="ct-feature-desc">{{ row.desc }}</span>
               </a>
               <span v-else class="ct-feature-plain">
@@ -350,16 +327,6 @@ thead tr {
   color: var(--vp-c-text-2);
 }
 
-.ct-ext-icon {
-  opacity: 0.35;
-  flex-shrink: 0;
-  transition: opacity 0.15s;
-}
-
-.ct-feature-link:hover .ct-ext-icon {
-  opacity: 0.75;
-}
-
 .ct-cell {
   padding: 14px 12px;
   text-align: center;

scripts/responsive.pw.ts

@@ -74,10 +74,13 @@ interface OverflowHit {
  *     the overflow is consumed inside that scroll container, not the page.
  *  2. Any ancestor is `position: fixed`: fixed containers are isolated from
  *     the page scroll. Their children can overflow the container but NEVER add
- *     to the document's horizontal scroll width (e.g. VitePress sticky navbar
- *     flyout menus at narrow-tablet breakpoints).
+ *     to the document's horizontal scroll width.
  *  3. The element itself is `position: fixed` (same reasoning).
- *  4. The element is invisible (`visibility: hidden` covers closed VitePress
+ *  4. The element (or an ancestor) matches a known VitePress nav class
+ *     (.VPNav, .VPNavBar, .VPLocalNav, .VPFlyout): these use `position: sticky`
+ *     and their flyout menus can temporarily exceed the viewport without
+ *     representing a real page-level overflow regression.
+ *  5. The element is invisible (`visibility: hidden` covers closed VitePress
  *     flyout panels that stay in the DOM but are not rendered).
  */
 async function findOverflowingElements(page: Page): Promise<OverflowHit[]> {
@@ -92,19 +95,23 @@ async function findOverflowingElements(page: Page): Promise<OverflowHit[]> {
         const s = window.getComputedStyle(parent);
         // Non-visible overflow-x: overflow absorbed by this scroll container
         if (s.overflowX !== "visible") return true;
-        // Fixed or sticky ancestor: children live in a separate layer and
+        // Fixed ancestor: children live in a separate stacking context and
         // can never contribute to the document horizontal scroll width.
-        // VitePress uses position:sticky (not fixed) for .VPNav/.VPNavBar.
-        if (s.position === "fixed" || s.position === "sticky") return true;
+        if (s.position === "fixed") return true;
+        // VitePress nav elements (sticky) — flyout menus can temporarily
+        // exceed the viewport; skip them by class to avoid false positives.
+        if (parent.matches(".VPNav, .VPNavBar, .VPLocalNav, .VPFlyout")) return true;
         parent = parent.parentElement;
       }
       return false;
     }
 
     for (const el of document.querySelectorAll("body *")) {
       const s = window.getComputedStyle(el);
-      // Skip the element itself if fixed or sticky (same isolation rule)
-      if (s.position === "fixed" || s.position === "sticky") continue;
+      // Skip fixed elements (isolated stacking context)
+      if (s.position === "fixed") continue;
+      // Skip VitePress nav containers (sticky, known flyout false positives)
+      if ((el as Element).closest(".VPNav, .VPNavBar, .VPLocalNav, .VPFlyout")) continue;
       // Skip invisible elements (closed VitePress flyout panels, etc.)
       if (s.visibility === "hidden" || s.display === "none") continue;
 

src/output.test.ts

@@ -190,7 +190,7 @@ describe("buildReplayDetails", () => {
     const out = buildReplayDetails(groups, QUERY, ORG, new Set(), new Set());
     expect(out).toContain("<details>");
     expect(out).toContain(
-      "<summary>[github-code-search](https://fulll.github.io/github-code-search/) replay command</summary>",
+      '<summary><a href="https://fulll.github.io/github-code-search/">github-code-search</a> replay command</summary>',
     );
     expect(out).toContain("```bash");
     expect(out).toContain("</details>");
@@ -296,7 +296,7 @@ describe("buildMarkdownOutput", () => {
     const out = buildMarkdownOutput(groups, QUERY, ORG, new Set(), new Set());
     expect(out).toContain("<details>");
     expect(out).toContain(
-      "<summary>[github-code-search](https://fulll.github.io/github-code-search/) replay command</summary>",
+      '<summary><a href="https://fulll.github.io/github-code-search/">github-code-search</a> replay command</summary>',
     );
     expect(out).toContain("```bash");
     expect(out).toContain("</details>");
@@ -314,7 +314,7 @@ describe("buildMarkdownOutput", () => {
     const out = buildMarkdownOutput(groups, QUERY, ORG, new Set(), new Set(), "repo-only");
     expect(out).toContain("<details>");
     expect(out).toContain(
-      "<summary>[github-code-search](https://fulll.github.io/github-code-search/) replay command</summary>",
+      '<summary><a href="https://fulll.github.io/github-code-search/">github-code-search</a> replay command</summary>',
     );
   });
 
@@ -324,7 +324,7 @@ describe("buildMarkdownOutput", () => {
     expect(out).toContain("myorg/repoA\nmyorg/repoB\n");
     expect(out).toContain("<details>");
     expect(out).toContain(
-      "<summary>[github-code-search](https://fulll.github.io/github-code-search/) replay command</summary>",
+      '<summary><a href="https://fulll.github.io/github-code-search/">github-code-search</a> replay command</summary>',
     );
   });
 

src/output.ts

@@ -108,7 +108,7 @@ export function buildReplayDetails(
   const shellCmd = raw.replace(/^# Replay:\n/, "");
   return [
     "<details>",
-    "<summary>[github-code-search](https://fulll.github.io/github-code-search/) replay command</summary>",
+    '<summary><a href="https://fulll.github.io/github-code-search/">github-code-search</a> replay command</summary>',
     "",
     "```bash",
     shellCmd,