fix(conventions): accept the template's trailing reference on the infrastructure checkbox

.github/workflows/conventions-contract-self-test.yml

@@ -0,0 +1,39 @@
+name: conventions contract self-test
+
+# Runs the delivery-conventions contract at this commit. The validator in
+# scripts/conventions/validate-pr.py gates every pull request in the
+# organization, and tests/conventions-contract.sh is its only test, but nothing
+# ran it: a change that broke a rule, or that disagreed with the repositories'
+# pull request templates, reached main unnoticed. That is how the infrastructure
+# checkbox came to reject the very line the templates print.
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - "scripts/conventions/validate-pr.py"
+      - "tests/conventions-contract.sh"
+      - ".github/workflows/conventions.yml"
+      - ".github/workflows/conventions-contract-self-test.yml"
+  push:
+    branches: [main]
+    paths:
+      - "scripts/conventions/validate-pr.py"
+      - "tests/conventions-contract.sh"
+      - ".github/workflows/conventions.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  contract-test:
+    name: conventions contract
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run the delivery-conventions contract
+        run: bash tests/conventions-contract.sh

scripts/conventions/validate-pr.py

@@ -225,7 +225,11 @@ def touches_infrastructure(changed_files: list[str]) -> bool:
 def infrastructure_checkbox_checked(body: str) -> bool:
     pattern = re.compile(
         rf"^[ \t]*-[ \t]*\[[xX]\][ \t]+{re.escape(INFRASTRUCTURE_CHECKBOX)}"
-        r"[ \t]*$",
+        # The repositories' templates end this line with a reference, for
+        # example "(`microservice-app-ai-agents/rules/mcp.md`)". The contract is
+        # the checked box, so anything the template itself adds after the label
+        # is accepted; the line must still start with the exact label.
+        r"[^\n]*$",
         re.MULTILINE,
     )
     return pattern.search(body) is not None

tests/conventions-contract.sh

@@ -198,6 +198,21 @@ expect_rejection "unchecked Kubernetes documentation checkbox" \
 expect_pass "checked infrastructure documentation checkbox" \
   "feat(ci): enforce pull request conventions" \
   "feat/pull-request-conventions" "$checked_body" true "modules/example/main.tf\n"
+
+# The repositories' pull request templates print this line with a trailing
+# reference: "... is listed above (`microservice-app-ai-agents/rules/mcp.md`)".
+# A body that keeps the template's own wording must pass; the checkbox is the
+# contract, not the absence of the reference the template itself supplies.
+template_suffix_body="${checked_body/is listed above/is listed above (\`microservice-app-ai-agents/rules/mcp.md\`)}"
+expect_pass "checked infrastructure checkbox with the template's trailing reference" \
+  "feat(ci): enforce pull request conventions" \
+  "feat/pull-request-conventions" "$template_suffix_body" true "modules/example/main.tf\n"
+
+unchecked_suffix_body="${valid_body/is listed above/is listed above (\`microservice-app-ai-agents/rules/mcp.md\`)}"
+expect_rejection "unchecked infrastructure checkbox with the template's trailing reference" \
+  "infrastructure documentation checkbox must be checked" \
+  "feat(ci): enforce pull request conventions" \
+  "feat/pull-request-conventions" "$unchecked_suffix_body" true "modules/example/main.tf\n"
 expect_pass "non-infrastructure repository ignores Terraform checkbox" \
   "feat(ci): enforce pull request conventions" \
   "feat/pull-request-conventions" "$valid_body" false "modules/example/main.tf\n"