Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

@@ -0,0 +15,4 @@
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

@@ -0,0 +15,4 @@
+import os
+import sys
+
+# realpath: a link such as ~/bin/<name> must still find the package of the checkout.

@@ -0,0 +107,4 @@
+    if which("pandoc") is None:
+        return None
+    html = os.path.join(os.path.dirname(report), "report.html")
+    run(["pandoc", report, "--standalone", "--metadata", f"title={title}", "--output", html], check=True,

@@ -0,0 +90,4 @@
+    def short(location):
+        return re.sub(r"[^\s:()]*/", "", location)
+    # A finding of this verdict says more than the reason that counts it: its title and file, without the directories.
+    finding = re.search(r"^\d+\. \*\*(.+?)\*\* at `([^`]+)`\n\n\s*" + word + ";", text, re.M)

@@ -0,0 +107,4 @@
+
+
+def write_html(report, title, run=subprocess.run, which=shutil.which):
+    """Writes report.html next to report.md with pandoc; returns its path, or None without pandoc."""

@@ -0,0 +117,4 @@
+    with open(header, "w", encoding="utf-8") as f:
+        f.write(f'<meta http-equiv="Content-Security-Policy" content="{CONTENT_SECURITY_POLICY}">\n')
+    try:
+        # markdown-raw_html: HTML in the draft, e.g. a <script> quoted in a finding, stays text.

@@ -0,0 +118,4 @@
+        f.write(f'<meta http-equiv="Content-Security-Policy" content="{CONTENT_SECURITY_POLICY}">\n')
+    try:
+        # markdown-raw_html: HTML in the draft, e.g. a <script> quoted in a finding, stays text.
+        run(["pandoc", report, "--from", "markdown-raw_html", "--standalone", "--metadata", f"title={title}",

@@ -0,0 +97,4 @@
+  read the secrets file, pass the read token, or the write token for `--attach`, to `tools/review-report`,
+  print the summary line and write `report.html` with pandoc.
+- `report.html` is strict Markdown without raw HTML, plus tables (`--from markdown_strict-raw_html+pipe_tables`):
+  no raw HTML, no YAML metadata block, no raw attribute; an own template puts a Content Security Policy without scripts first into the head

@@ -0,0 +165,4 @@
+        env = {**environ, **(read_secrets(settings["secrets"]) if settings.get("secrets") else {})}
+        # Only --attach writes to Gitea, so only it gets the token that may write.
+        name = settings.get("write_token_variable") if args.attach else settings["read_token_variable"]
+        if not name or not env.get(name):