@grimoire-rs/indexer 0.1.7 → 0.1.9

package/dist/renderer/astro/layouts/Base.astro

@@ -329,6 +329,20 @@ const brandRest =
         .install-row code::-webkit-scrollbar {
           display: none;
         }
+        /* The one row whose action is the link itself rather than a command
+           to copy, so it spans the code and copy-button columns. */
+        .install-row .vscode-add {
+          grid-column: 2 / -1;
+          justify-self: start;
+          font-size: 0.85rem;
+          font-weight: 500;
+          color: var(--accent);
+          text-decoration: none;
+        }
+        .install-row .vscode-add:hover,
+        .install-row .vscode-add:focus-visible {
+          text-decoration: underline;
+        }
         /* The `[[registries]]` snippet is the one multi-line command: let it
            wrap inside its cell instead of scrolling a three-line block. */
         .install-row code.block {

package/dist/renderer/astro/lib/catalog.d.ts

@@ -4,4 +4,18 @@ export declare function compareVersions(a: string, b: string): number;
 export declare function timeAgo(iso: string): string;
 /** `vscode://<publisher.extension>/open?repo=<ref>`, or null when disabled. */
 export declare function vscodeUrl(extension: string | null, ref: string): string | null;
+/**
+ * `vscode://<publisher.extension>/add-registry?index=<url>&alias=<name>` — the
+ * one-click counterpart of the `grim config registry add` line beside it.
+ *
+ * Null unless the link would actually work: the handler takes https only (an
+ * index locator is fetched with whatever credentials the user configures for
+ * it), refuses embedded credentials, and caps the URL at 2048 characters.
+ * Checking here keeps a broken button off the page rather than putting the
+ * failure in the user's hands.
+ */
+export declare function addRegistryUrl(extension: string | null, registry: {
+    alias: string;
+    index: string;
+} | null): string | null;
 //# sourceMappingURL=catalog.d.ts.map

package/dist/renderer/astro/lib/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../../src/renderer/astro/lib/catalog.ts"],"names":[],"mappings":"AAOA,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKrD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAWpF;AAID,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAa5D;AAcD,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAS3C;AAED,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE9E"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../../src/renderer/astro/lib/catalog.ts"],"names":[],"mappings":"AAOA,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKrD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAWpF;AAID,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAa5D;AAcD,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAS3C;AAED,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE9E;AAUD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,QAAQ,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAChD,MAAM,GAAG,IAAI,CAYf"}

package/dist/renderer/astro/lib/catalog.js

@@ -58,4 +58,38 @@ export function timeAgo(iso) {
 export function vscodeUrl(extension, ref) {
     return extension ? `vscode://${extension}/open?repo=${encodeURIComponent(ref)}` : null;
 }
+/**
+ * Alias charset the extension's `/add-registry` handler accepts. It has to be
+ * a TOML bare key and safe as a CLI argument, so it refuses a link rather
+ * than escaping one. Mirrored here so a config that cannot produce a working
+ * link renders no button at all, instead of one that silently does nothing.
+ */
+const REGISTRY_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$/;
+/**
+ * `vscode://<publisher.extension>/add-registry?index=<url>&alias=<name>` — the
+ * one-click counterpart of the `grim config registry add` line beside it.
+ *
+ * Null unless the link would actually work: the handler takes https only (an
+ * index locator is fetched with whatever credentials the user configures for
+ * it), refuses embedded credentials, and caps the URL at 2048 characters.
+ * Checking here keeps a broken button off the page rather than putting the
+ * failure in the user's hands.
+ */
+export function addRegistryUrl(extension, registry) {
+    if (!extension || !registry || !REGISTRY_ALIAS.test(registry.alias))
+        return null;
+    let url;
+    try {
+        url = new URL(registry.index);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== "https:" || url.username !== "" || url.password !== "")
+        return null;
+    if (url.href.length > 2048)
+        return null;
+    const query = new URLSearchParams({ index: url.href, alias: registry.alias });
+    return `vscode://${extension}/add-registry?${query.toString()}`;
+}
 //# sourceMappingURL=catalog.js.map

package/dist/renderer/astro/lib/catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../../../src/renderer/astro/lib/catalog.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAQtC,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,OAA2B,EAAE,IAAc;IACxE,MAAM,MAAM,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAC/E,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC5C,CAAC;IACF,2EAA2E;IAC3E,qDAAqD;IACrD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,yEAAyE;AACzE,8CAA8C;AAC9C,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAChC,CAAC;aAAM,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iEAAiE;AACjE,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACnE,MAAM,cAAc,GAA4C;IAC9D,CAAC,EAAE,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,EAAE,OAAO,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,EAAE,EAAE,QAAQ,CAAC;IACd,CAAC,QAAQ,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC,wCAAwC;IAC7E,IAAI,QAAQ,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACxC,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/E,QAAQ,IAAI,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,SAAwB,EAAE,GAAW;IAC7D,OAAO,SAAS,CAAC,CAAC,CAAC,YAAY,SAAS,cAAc,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzF,CAAC"}
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../../../src/renderer/astro/lib/catalog.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAQtC,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,OAA2B,EAAE,IAAc;IACxE,MAAM,MAAM,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAC/E,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC5C,CAAC;IACF,2EAA2E;IAC3E,qDAAqD;IACrD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,yEAAyE;AACzE,8CAA8C;AAC9C,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAChC,CAAC;aAAM,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iEAAiE;AACjE,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACnE,MAAM,cAAc,GAA4C;IAC9D,CAAC,EAAE,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,EAAE,OAAO,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,EAAE,EAAE,QAAQ,CAAC;IACd,CAAC,QAAQ,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC,wCAAwC;IAC7E,IAAI,QAAQ,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACxC,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/E,QAAQ,IAAI,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,SAAwB,EAAE,GAAW;IAC7D,OAAO,SAAS,CAAC,CAAC,CAAC,YAAY,SAAS,cAAc,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAwB,EACxB,QAAiD;IAEjD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9E,OAAO,YAAY,SAAS,iBAAiB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;AAClE,CAAC"}

package/dist/renderer/astro/lib/catalog.ts

@@ -67,3 +67,38 @@ export function timeAgo(iso: string): string {
 export function vscodeUrl(extension: string | null, ref: string): string | null {
   return extension ? `vscode://${extension}/open?repo=${encodeURIComponent(ref)}` : null;
 }
+
+/**
+ * Alias charset the extension's `/add-registry` handler accepts. It has to be
+ * a TOML bare key and safe as a CLI argument, so it refuses a link rather
+ * than escaping one. Mirrored here so a config that cannot produce a working
+ * link renders no button at all, instead of one that silently does nothing.
+ */
+const REGISTRY_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$/;
+
+/**
+ * `vscode://<publisher.extension>/add-registry?index=<url>&alias=<name>` — the
+ * one-click counterpart of the `grim config registry add` line beside it.
+ *
+ * Null unless the link would actually work: the handler takes https only (an
+ * index locator is fetched with whatever credentials the user configures for
+ * it), refuses embedded credentials, and caps the URL at 2048 characters.
+ * Checking here keeps a broken button off the page rather than putting the
+ * failure in the user's hands.
+ */
+export function addRegistryUrl(
+  extension: string | null,
+  registry: { alias: string; index: string } | null,
+): string | null {
+  if (!extension || !registry || !REGISTRY_ALIAS.test(registry.alias)) return null;
+  let url: URL;
+  try {
+    url = new URL(registry.index);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.username !== "" || url.password !== "") return null;
+  if (url.href.length > 2048) return null;
+  const query = new URLSearchParams({ index: url.href, alias: registry.alias });
+  return `vscode://${extension}/add-registry?${query.toString()}`;
+}

package/dist/renderer/astro/pages/index.astro

@@ -2,10 +2,16 @@
 import Base from "../layouts/Base.astro";
 import Catalog from "../components/Catalog.tsx";
 import CopyButton from "../components/CopyButton.astro";
+import { addRegistryUrl } from "../lib/catalog";
 import { data } from "../lib/data";
 
 const { config, packages } = data;
 
+// One-click counterpart of the `grim config registry add` line: the VS Code
+// extension registers a URI handler that writes the registry after a modal
+// confirmation. Null whenever the link would not work — see `addRegistryUrl`.
+const addRegistry = addRegistryUrl(config.vscodeExtension, config.registry);
+
 // The "add this index" ergonomic (`helm repo add`): the command a visitor
 // needs to point their own grim at *this* index, plus the equivalent
 // hand-edit. Absent `registry` config means the index has no public URL to
@@ -60,6 +66,14 @@ const registryRows = config.registry
               <CopyButton value={row.command} label={row.label} />
             </div>
           ))}
+          {addRegistry && (
+            <div class="install-row">
+              <span class="os">VS Code</span>
+              <a class="vscode-add" href={addRegistry}>
+                Add this index to VS Code
+              </a>
+            </div>
+          )}
         </div>
       )
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grimoire-rs/indexer",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "CLI + Astro integration for running your own grim package index",
   "type": "module",
   "license": "Apache-2.0",

package/templates/reusable/gitlab-index-ci.yml

@@ -73,7 +73,12 @@ grim-indexer:validate:
       set -eu
       git fetch --quiet origin "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
       git worktree add --detach ../base "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
-      git diff --name-only --diff-filter=ACMR "$CI_MERGE_REQUEST_DIFF_BASE_SHA" HEAD -- index > changed.txt
+      # Every changed path, with no pathspec and no diff filter: rejecting an
+      # out-of-bounds path is the gate's first job, and it ownership-checks a
+      # deletion before allowing it. Narrowing to `-- index` would let an MR
+      # that adds a valid entry and edits this very file pass; dropping `D`
+      # would let one that deletes a stranger's entry pass.
+      git diff --name-only "$CI_MERGE_REQUEST_DIFF_BASE_SHA" HEAD > changed.txt
       xargs -a changed.txt npx --yes "@grimoire-rs/indexer@$GRIM_INDEXER_VERSION" validate \
         --forge gitlab --root ../base --pr-tree .