[Cedric Vidal (cedricvidal)]

Summary

• fix the Pages privacy assertion regression introduced by contributor avatars in feat(website): thank merged contributors #1456
• allow only valid GitHub login avatar URLs and GitHub's exact numeric avatar redirect shape
• continue failing the test for every other unexpected external request
• allowlist the documented Microsoft 1DS public browser instrumentation identifier shape only for Gitleaks' generic-api-key rule
• scope the rotation-friendly exception to the instrumentationKey: property syntax and exactly the production analytics script and its test

Demos

N/A — test-only change with no user-visible behavior change.

Before

N/A

After

N/A

Testing

• pnpm --dir website test — passed, 20 tests
• pnpm --dir website exec playwright test tests/accessibility.spec.ts — passed, 36 tests after generating the production build (the initial fresh-worktree run could not start because website/dist did not exist)
• SITE=https://microsoft.github.io BASE_PATH=/scope pnpm --dir website run build — passed
• pnpm --dir website exec playwright test — passed, 92 tests
• temporary Gitleaks fixture in website/src/scripts/analytics.ts — a rotated 1DS-shaped instrumentationKey was allowlisted, while an unrelated apiKey and a differently shaped instrumentationKey were both detected
• gitleaks git . --log-opts="--all" --config .gitleaks.toml --redact --no-banner --exit-code 1 with Gitleaks v8.30.1 — passed, 4,463 commits scanned, no leaks found
• GitHub Pages build check — passed in 2m43s
• GitHub Secret Scan gitleaks check — passed in 8s

The pre-existing analytics Fetch response has been disposed flake did not occur.

Documentation and compatibility

None. This changes only test and secret-scan allowlists and has no API, CLI, deployment, or compatibility impact.

Checklist

• If Portal features changed, keep CLI capabilities in sync. (N/A — Portal unchanged.)
• If Portal components changed, update their Storybook stories. (N/A — Portal unchanged.)
• If database changes require a migration, include up() / down() and keep it CosmosDB-compatible. (N/A — no database changes.)
• If dependencies changed, update the lockfile and regenerate NOTICE / NOTICE-REVIEW.txt with pnpm notice as needed. (N/A — no dependency changes.)
• Video showing the behavior before the suggested change (N/A — test-only change.)
• Video showing the behavior after the suggested change (N/A — test-only change.)