Fix: Harden metadata validation, error propagation, and CI automation

[mertcano]

Description

This PR addresses several reliability, security, and accuracy defects identified during the workspace-wide audit[cite: 63]. It improves file path validation, ensures robust error propagation to GitHub comments, prevents false-green validation states, and hardens the release automation workflows[cite: 63].

Key Changes

• Validation & Path Integrity (src/scripts/validate-fs.ts, src/scripts/validate-entity.ts):
  • Replaced platform-dependent path splitting with normalized, exact-segment validation enforcing the {entityType}/{identifier}/{fileName} structure[cite: 63].
  • Scoped changed-file detection specifically to the selected entity and added explicit errors for missing valid entity files[cite: 63].
  • Replaced eager registry-address reads with lazy input-name resolution so optional validation does not strictly depend on unrelated inputs[cite: 63].
• Error Propagation & Source Maps (src/scripts/validate-*.ts, src/main.ts, src/scripts/github.ts):
  • File-read, JSON-parse, image-decode, and RPC failures now correctly post an English GitHub comment/review before throwing an error[cite: 63].
  • Replaced any with a typed source-map shape in normalizeErrors and used nullish coalescing to prevent || 1 from incorrectly converting source-map line 0, preserving exact zero-based source positions[cite: 63].
  • Modified Promise.allSettled() handling to normalize non-Error rejection values so they are no longer silently discarded, ensuring every thrown value reaches core.setFailed()[cite: 63].
  • Added viem.isAddress() checks for reward addresses prior to executing contract calls[cite: 63].
• Release Automation (.github/workflows/full-info.yml, extract-metadata.mjs):
  • Removed ad-hoc runtime dependency installations (npm install) and TypeScript compilation (npx)[cite: 63].
  • The metadata generator was rewritten as a dependency-free standard-library Node.js .mjs module that the workflow now executes directly[cite: 63, 66, 67].
• Workflow Least Privilege (.github/workflows/Validate_Pull_Request.yml):
  • Removed the potentially unsafe pull_request_target trigger[cite: 63]. The PR-agent action now strictly runs only for same-repository pull requests (github.event.pull_request.head.repo.full_name == github.repository) to safeguard the OpenAI secret boundary[cite: 63, 68].
• Documentation (README.md, .github/copilot-instructions.md):
  • Updated documentation to reflect the bundled dist/index.cjs distribution, enforce space-separated file inputs, and include adapters[cite: 63, 64, 65].
  • Clarified that token identifiers are no longer checked against a registry, distinguishing strictly between on-chain identifiers and actively configured registries[cite: 63, 64, 65].

[github-actions]

Failed to generate code suggestions for PR