Add CI guard for relative links on index.md/index.mdx pages

[digitaldiina]

Summary

Adds an advisory-only CI guard, modeled on the existing tools/ci/*-guard.py + .github/workflows/*-guard.yml family (e.g. landing-page-template-guard, release-notes-api-structure-guard), that flags a relative (./ or ../) markdown link or HTML/JSX href authored on an index.md/index.mdx page.

This is the exact bug class root-caused and fixed repo-wide in #375 and #377: a page built from a literal index.md/index.mdx file serves at its folder's own bare path with no trailing slash, so a relative link written on that page resolves against the wrong parent folder in production. The target genuinely exists on disk, so no existing static check catches it (mint validate doesn't check links at all; tools/triage-broken-links.py resolves relative links via filesystem path math against the source file's disk location, not the live URL).

• New tools/ci/check-index-relative-links.py: flags inline/reference-style markdown links and HTML/JSX href values starting with .//../ on index.md/index.mdx files. Skips fenced code blocks, inline code spans, MDX import statements, the YAML frontmatter block (redirect_from/related hold path-like values but aren't rendered links), and the machine-generated reference trees. Advisory only - always exits 0.
• New .github/workflows/index-relative-links-guard.yml: runs the script against a PR's changed index.md/index.mdx files.
• Security: paths from the changed-files list are resolved against the repo root and rejected if they'd escape it (defends against a crafted PR-diff filename). The workflow passes the changed-files list through env: rather than interpolating the ${{ }} expression directly into the run: script body - direct interpolation is a known GitHub Actions script-injection vector (a filename containing $(...)/backticks could execute). Note: every sibling guard workflow in this repo shares that same latent pattern; out of scope to fix here, filing as a separate follow-up.
• Documented in contribute/automated-tests.mdx (new table row + detail section) and tools/README.md; referenced from contribute/review/index.mdx's "What to check" list.

Note: found real leftover instances of this bug while building the guard

Running the new script against the current repo (not part of this PR's scope to fix) found #377's repo-wide fix was incomplete - roughly 172 relative links remain, almost entirely raw HTML <a href="./..."> links in landing-page "concept-links" card blocks that the earlier fix's markdown-only pattern didn't match, plus a handful of reference-style link definitions. Filing a separate follow-up issue/PR for that; not fixed here since #378 only asks for the guard.

Closes #378

Test plan

• Ran the script against a synthetic fixture covering all excluded shapes (fenced code, inline code span, MDX import, frontmatter redirect_from/related) plus 3 real hit shapes (markdown link, reference-style def, HTML href) - only the 3 real hits were flagged.
• Ran --path contribute against the current repo (including the newly-edited contribute/review/index.mdx) - zero hits, confirming the PR's own dogfood file stays clean.
• markdownlint-cli2 on both touched content files - no new issues vs. main's baseline (the one MD053 hit on contribute/review/index.mdx is a pre-existing, already-documented false positive, confirmed via diff against origin/main).
• Confirm the new workflow triggers on this PR's own diff (it touches contribute/review/index.mdx, an in-scope index page) and reports zero warnings.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
superofficeas	🟢 Ready	View Preview	Sep 1, 2026, 9:59 AM