Validate GitHub links against local filesystem to catch PR-induced broken links #1500

Copilot · 2026-01-13T23:41:14Z

Verify-Links.ps1 only checked links against remote state, missing cases where PRs delete referenced files or create files for non-Azure orgs.

Changes

Verify-Links.ps1:

Added localBuildTargetBranch parameter to receive PR target branch from $env:SYSTEM_PULLREQUEST_TARGETBRANCH
Extended GitHub link matching from Azure org only to any org (microsoft, Azure, etc.)
Added support for raw.githubusercontent.com URLs alongside github.com/blob|tree format
Check local filesystem when link matches currentRepo + targetBranch:
- File exists locally → pass (PR creates/maintains file)
- File missing locally → fail (PR would break link)
- Otherwise → HTTP check (existing behavior)
Security: Use [^#?]* instead of .* in regex (ReDoS prevention), log relative paths only

verify-links.yml:

Pass -localBuildTargetBranch "$env:SYSTEM_PULLREQUEST_TARGETBRANCH" to script

Example

# Before: Link to Azure org only
'^https://github.com/(?<org>Azure)/(?<repo>[^/]+)/(?:blob|tree)/(main|.*_[^/]+|.*/v[^/]+)/(?<path>.*)$'

# After: Any org + target branch check
'^https://github\.com/(?<org>[^/]+)/(?<repo>[^/]+)/(?:blob|tree)/(?<branch>[^/]+)/(?<path>[^#?]*)$'

if ($localBuildTargetBranch -and $branch -eq $localBuildTargetBranch) {
  Test-Path (Join-Path $localBuildRepoPath $path)  # Validate against PR workspace
}

Impact:

PR deleting docs/guide.md with link to it now fails validation
PR creating docs/new.md with link to it now passes validation

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

aka.ms
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
azure.github.io
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
cla.opensource.microsoft.com
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
go.microsoft.com
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
insiders.vscode.dev
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
learn.microsoft.com
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
marketplace.eclipse.org
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
marketplace.visualstudio.com
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
modelcontextprotocol.io
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
opensource.microsoft.com
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
plugins.jetbrains.com
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
spec.modelcontextprotocol.io
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
vscode.dev
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)
www.nuget.org
- Triggering command: /usr/bin/pwsh pwsh /tmp/test_real_repo.ps1 (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-String -Pattern 'Checked|broken' (dns block)
- Triggering command: /usr/bin/pwsh pwsh -c & ./eng/common/scripts/Verify-Links.ps1 -urls ./README.md -localBuildRepoName 'microsoft/mcp' -localBuildRepoPath . -localBuildTargetBranch 'main' -recursive $false 2>&1 | Select-Object -Last 5 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

This section details on the original issue you should resolve

<issue_title>Link validation doesn't catch GH link changes in the current PR</issue_title>
<issue_description>Readmes are checked for broken links using Verify-Links.ps1. That script checks that the URLs in a markdown or html file are valid and don't return an error result, e.g. 404.

The current script doesn't detect that a PR will be deleting a file that a url targets. It also doesn't detect that a change creates a file that a url targets when the github org isn't Azure.

We should improve the script so that:

validation fails if the current PR deletes a file that a url references (when the url targets main, etc)

validation succeeds if the current PR creates a file that a url references (even when the github org != 'azure')</issue_description>

Comments on the Issue (you are @copilot in this section)
@hallipr Copilot, update the link validation script to check for local files when verifying any github link that would be based off of the current repo and target branch. I want a link check to fail if this pr **would** break a link.
For example, when the target branch of a PR is main, any github.com or githubusercontent.com that point to the current repo and the branch main should check the local filesystem for the file rather than the current remote state of the url.</comment_new>

Fixes Link validation doesn't catch GH link changes in the current PR #982

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: hallipr <1291634+hallipr@users.noreply.github.com>

…groups Co-authored-by: hallipr <1291634+hallipr@users.noreply.github.com>

Co-authored-by: hallipr <1291634+hallipr@users.noreply.github.com>

hallipr · 2026-01-22T19:05:43Z

eng/common/pipelines/templates/steps/verify-links.yml

        -localBuildRepoName "$env:BUILD_REPOSITORY_NAME"
        -localBuildRepoPath $(Build.SourcesDirectory)
+        -localBuildTargetBranch "$env:SYSTEM_PULLREQUEST_TARGETBRANCH"


Prefer yaml variable syntax over environment variable syntax

Suggested change

-localBuildRepoName "$env:BUILD_REPOSITORY_NAME"

-localBuildRepoPath $(Build.SourcesDirectory)

-localBuildTargetBranch "$env:SYSTEM_PULLREQUEST_TARGETBRANCH"

-localBuildRepoName "$(Build.Repository.Name)"

-localBuildRepoPath $(Build.SourcesDirectory)

-localBuildTargetBranch "$(System.PullRequest.TargetBranch)"

Initial plan

235b2e3

Copilot AI assigned Copilot and hallipr Jan 13, 2026

github-project-automation bot added this to Azure MCP Server Jan 13, 2026

github-project-automation bot moved this to Untriaged in Azure MCP Server Jan 13, 2026

Copilot started work on behalf of hallipr January 13, 2026 23:41 View session

Copilot AI and others added 4 commits January 13, 2026 23:45

Update link validation to check local files for any GitHub org

30af869

Co-authored-by: hallipr <1291634+hallipr@users.noreply.github.com>

Address security concerns: prevent ReDoS and protect filesystem paths

d3bedbd

Co-authored-by: hallipr <1291634+hallipr@users.noreply.github.com>

Fix code review issues: simplify path logging and remove empty regex …

a5d9260

…groups Co-authored-by: hallipr <1291634+hallipr@users.noreply.github.com>

Fix wiki link regex pattern to properly match http/https schemes

ee0a051

Co-authored-by: hallipr <1291634+hallipr@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update link validation to catch URL changes in PRs~~ Validate GitHub links against local filesystem to catch PR-induced broken links Jan 13, 2026

Copilot AI requested a review from hallipr January 13, 2026 23:56

Copilot finished work on behalf of hallipr January 13, 2026 23:56

hallipr reviewed Jan 22, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Validate GitHub links against local filesystem to catch PR-induced broken links #1500

Validate GitHub links against local filesystem to catch PR-induced broken links #1500

Uh oh!

Copilot AI commented Jan 13, 2026 •

edited

Loading

Uh oh!

hallipr Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Validate GitHub links against local filesystem to catch PR-induced broken links #1500

Are you sure you want to change the base?

Validate GitHub links against local filesystem to catch PR-induced broken links #1500

Uh oh!

Conversation

Copilot AI commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Example

I tried to connect to the following addresses, but was blocked by firewall rules:

Comments on the Issue (you are @copilot in this section)

Uh oh!

hallipr Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 13, 2026 •

edited

Loading