.claude/skills/recipe-report/SKILL.md

@@ -42,10 +42,17 @@ keeps every weekly edition looking the same regardless of which model writes the
        Advisories + vendor security pages + OSV, with severities and fixed-in versions). Treat its
        CVE list as a **further source** and report the **UNION** of it and what you found by reading.
        Its entries are machine-derived with advisory IDs, so prefer them for CVE ids / severities /
-       fixed-in versions, and cite the GHSA where present in the Security Bulletin. If a recipe has
-       no scan block, or the block lists **failed sources**, the count is **not** authoritative:
-       render the cve cell as `?` (unknown), never `none` — a blank that reads as "clean" is exactly
-       how two CVSS-9.8 gitea RCEs were reported as "none" on 2026-08-07.
+       fixed-in versions, and cite the GHSA where present in the Security Bulletin. If the block
+       lists **failed sources**, the count is **not** authoritative: render the cve cell as `?`
+       (unknown), never `none` — a blank that reads as "clean" is exactly how two CVSS-9.8 gitea
+       RCEs were reported as "none" on 2026-08-07.
+     - **`?` must stay RARE — it means "we tried and could not tell", not "we didn't look".** Use it
+       ONLY when a scan ran and reported genuinely failed sources. In particular: a recipe with **no
+       upgrade this run** (up-to-date/skipped) has nothing an upgrade could have fixed — report `0`,
+       not `?`. A recipe with a clean scan reports its number (including `0`). Benign notes in a scan
+       block (`no-advisories-published`, `skipped: template URL`) are NOT failures and must not
+       trigger `?`. If you find yourself rendering `?` for many recipes, that is a bug to report in
+       the Addendum, not a normal outcome.
      Anything **critical/high** also gets a `security` bulletin entry (recipe · CVE id(s) + severity ·
      what it fixes · PR link); be specific about severity and what's exposed if not merged.
    - **Lead — ONE short paragraph.** A tight, concrete opener in opus's voice: fleet state in a sentence

cc-ci-plan/advisory-scan.py

@@ -114,8 +114,12 @@ def registry_urls(recipe: str, registry_dir: str) -> tuple[list[str], str | None
         return [], None
     urls = []
     for u in re.findall(r"https?://[^\s)|\]]+", text):
-        u = u.rstrip(".,;")
-        if u not in urls:
+        # The registry is MARKDOWN: urls appear inside `backticks`, 'quotes', **bold**, and at the
+        # end of sentences. Trailing punctuation captured into the url makes the fetch 404 and the
+        # recipe render '?' for no real reason — that is what put immich and n8n in the unknown
+        # column on 2026-08-07 (https://docs.n8n.io/release-notes/` ← note the backtick).
+        u = u.rstrip("`'\"*.,;:>)")
+        if u and u not in urls:
             urls.append(u)
     return urls, path
 

cc-ci-plan/upstream/mattermost-lts.md

@@ -2,7 +2,7 @@
 
 | service  | image                                     | source repo                                       | releases / changelog                                              |
 |----------|-------------------------------------------|---------------------------------------------------|-------------------------------------------------------------------|
-| app      | mattermost/mattermost-team-edition        | https://github.com/mattermost/mattermost          | https://docs.mattermost.com/about/mattermost-changelog.html       |
+| app      | mattermost/mattermost-team-edition        | https://github.com/mattermost/mattermost          | https://docs.mattermost.com/deploy/mattermost-changelog.html       |
 | postgres | postgres                                  | https://github.com/postgres/postgres              | https://www.postgresql.org/docs/release/                          |
 
 ## Standing notes