fix: tests were based on static, not dynamic versions

.github/workflows/deploy.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Install Just
         # taiki-e/install-action v2.87.13
-        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68
+        uses: taiki-e/install-action@3a3daafd3b7f23b8f65d9f5ba2db203fb59b79e2
         with:
           tool: just@1.59.0
 

docs/decisions/0006-local-path-check.md

@@ -33,6 +33,15 @@ untouched. The check was narrowed, not disabled.
 The patterns live in `src/src/lib/build-paths.ts` and are imported by both `src/scripts/check-generated.ts`
 and the dist test suite, so the script and the tests cannot drift apart.
 
+### 4. Cache and dependency directories must sit on an absolute path
+
+*(Amendment, 2026-11-09.)* The `.cache`/`node_modules` rule originally matched those segments anywhere.
+Aggregated documentation legitimately names a location relative to the reader's own project — astroc4
+documents its cache as `node_modules/.cache/astroc4` — and that is content, not a build-machine path.
+The rule now requires an absolute path (a drive prefix or a root `/`) before the segment, so a real
+leak such as `/home/runner/work/…/node_modules/…` or `D:\build\node_modules\…` is still caught while
+documentation is not. This refines decision 2; it does not disable any security pattern.
+
 ## Consequences
 
 - Documentation that shows an absolute path on a non-system drive (or a drive example such as

src/src/lib/build-paths.ts

@@ -33,8 +33,11 @@ export const LOCAL_PATH_PATTERNS: readonly RegExp[] = [
   /[A-Za-z]:\\(?:actions-runner|hostedtoolcache|runneradmin)\\/i, // CI runner dirs
   /\/Users\/[^\s"']+/, // macOS home paths (case-sensitive)
   /\/home\/[A-Za-z0-9._-]+\//, // Linux home paths
-  /\.cache[/\\]/,
-  /node_modules[/\\]/,
+  // A cache/dependency directory is only machine-identifying when it sits on
+  // an absolute path. Aggregated documentation legitimately names
+  // `node_modules/.cache/<tool>` as a location relative to the consumer's
+  // project, and that names no machine, so it must not fail the scan.
+  /(?:[A-Za-z]:[\\/]|(?<![\w:/\\*?])\/)[^\s"']*(?:\.cache|node_modules)[\\/]/i,
 ];
 
 /** The first pattern that matches `content`, or null when none does. */

src/tests/dist/built-output.test.ts

@@ -304,11 +304,15 @@ describe('built package versions', () => {
     const pkg = summary.packages.find((entry) => entry.packageId === 'Purview.ZodSharp.Http');
     expect(pkg).toBeDefined();
     expect(pkg?.latestStable).toBeNull();
-    expect(pkg?.latestPrerelease).toBe('3.0.0-prerelease.2');
+    // The package line keeps moving, so the expectation comes from the release
+    // data the site was built with rather than a pinned version. Otherwise every
+    // new prerelease turns a green build red without a product regression.
+    const latestPrerelease = pkg?.latestPrerelease;
+    expect(latestPrerelease).not.toBeNull();
 
     const content = requireBuilt('projects/zodsharp/index.html');
     expect(content).toContain('Purview.ZodSharp.Http');
-    expect(content).toContain('3.0.0-prerelease.2');
+    expect(content).toContain(latestPrerelease!);
   });
 });
 

src/tests/unit/build-paths.test.ts

@@ -20,15 +20,21 @@ describe('build-output safety patterns', () => {
     String.raw`C:\hostedtoolcache\windows\dotnet\10.0.0`,
     '/Users/bob/source/repo',
     '/home/runner/work/purview-dev/purview-dev',
-    'src/.cache/docs/index.json',
-    'node_modules/astro/package.json',
+    '/opt/build/.cache/docs/index.json',
+    String.raw`D:\build\node_modules\astro\package.json`,
   ];
 
   const documentation = [
     String.raw`D:\wslc-images`,
     String.raw`StoragePath = @"D:\wslc-images",`,
     String.raw`%LOCALAPPDATA%\Purview\WslContainers\images`,
     '/mnt/d/wslc-images',
+    // Relative cache/dependency locations are instructions, not machine paths.
+    'node_modules/.cache/astroc4',
+    'node_modules/astro/package.json',
+    'src/.cache/docs/index.json',
+    'LikeC4 ignores **/node_modules/**',
+    'cache at **/.cache/**',
   ];
 
   test('flags build-machine paths', () => {