fix: poetry upstream resolution, health-check detection, and dead release links

[CybotTM]

Three related upstream/version-correctness fixes, all surfaced from a real
make update/make upgrade run.

1. poetry showed latest: n/a

_derive_source() returned skip for poetry: its homepage python-poetry.org
matches neither python.org nor pypi.org, and install_method: package_manager
carries no pip/uv_tool hint. Now the catalog can declare an explicit
source_kind, and poetry.json sets pypi → resolves latest from PyPI.

2. Health check ignored poetry

check_python_package_managers.sh only knew pip/pipx, so uv + poetry
reported "Only uv – optimal". It now detects poetry and conda too, counts
them, and drops the "optimal" verdict when they're present (with a note that
poetry is a project-level manager, removable if unused).

3. Dead release links (missing v)

GitHub/GitLab release URLs were built from the normalized version
(…/releases/tag/1.7.12), but the real tag is v1.7.12 → 404. The
collectors now return the raw tag for the URL while still normalizing the
version number for display/compare. Confirmed live: actionlint's URL is now
…/releases/tag/v1.7.12 → HTTP 200. make update also hyperlinks the
latest version (was unlinked; respects CLI_AUDIT_LINKS=0).

Verification

• pytest: 642 passed, 1 skipped (+8 new tests: explicit source_kind,
  raw-tag URLs for gh/gitlab, collector raw-tag returns, health-check detection).
• Gating flake8 (E9,F63,F7,F82): clean. Smoke: pass.
• Live checks: poetry → 2.4.1 from PyPI; actionlint link → 200.

Note: the committed upstream_versions.json baseline still holds the old
v-less URLs; those refresh on the next make update-baseline (kept out of
this PR to avoid mixing in unrelated version bumps). make upgrade re-collects
live, so it's fixed immediately by the code change.

No version bump / CHANGELOG (feature branch).

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov]

Codecov Report

❌ Patch coverage is 70.96774% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.33%. Comparing base (77ab3b1) to head (1e9867e).

Files with missing lines	Patch %	Lines
cli_audit/collectors.py	57.89%	8 Missing ⚠️
cli_audit/catalog.py	90.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #102      +/-   ##
==========================================
+ Coverage   69.82%   71.33%   +1.50%     
==========================================
  Files          22       22              
  Lines        3347     3359      +12     
==========================================
+ Hits         2337     2396      +59     
+ Misses       1010      963      -47     

Flag	Coverage Δ
unittests	71.33% <70.96%> (+1.50%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gemini-code-assist]

Code Review

This pull request introduces support for explicit upstream source declarations in the tool catalog (allowing tools like Poetry to resolve to PyPI), preserves raw tags from GitHub and GitLab to ensure release URLs resolve correctly, and updates the Python package manager health check script to detect Poetry and Conda. The review feedback highlights several improvement opportunities: sanitizing URLs before terminal output to prevent escape sequence injection, handling string values robustly when parsing source_args, and adding defensive type checks on parsed JSON responses from external APIs to prevent potential runtime errors.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Copilot]

Pull request overview

This PR improves upstream version correctness and user-facing output around Python tooling and release links by (1) allowing catalog entries to explicitly define their upstream source, (2) preserving raw VCS tags for release URL construction, and (3) expanding the Python package manager health check to recognize additional tools.

Changes:

• Add source_kind / source_args support in the catalog and set poetry to resolve upstream versions via PyPI.
• Update GitHub/GitLab collectors to return raw tags (for correct release URLs) while still extracting normalized version numbers.
• Extend check_python_package_managers.sh detection to include poetry and conda, and hyperlink latest versions in cmd_update progress output; add targeted tests.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/test_upstream_links.py	Adds regression tests for explicit source_kind, raw-tag URLs, and health-check detection.
scripts/check_python_package_managers.sh	Detects poetry/conda, counts them, and adjusts messaging/“optimal” verdict logic.
cli_audit/collectors.py	Preserves raw release tags from GitHub/GitLab while extracting normalized version numbers.
cli_audit/catalog.py	Allows catalog JSON to explicitly declare upstream source routing (source_kind/source_args).
catalog/poetry.json	Declares poetry upstream as PyPI via source_kind: pypi.
audit.py	Hyperlinks the “latest” value in cmd_update progress output using OSC8 when enabled.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.