fix: align signature status, secure footer link, and fix nested interactive elements

[Copilot]

Description

Addresses 3 unresolved review comments from PR #398:

1. Signature status mismatch between workflow and UI
2. Missing security attribute on footer link
3. Invalid nested interactive elements in build-info page

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code refactoring
• Performance improvement
• Test updates

Related Issues

Relates to #398

Changes Made

1. Signature Status Alignment

File: .github/workflows/release.yml

- SIGNATURE_STATUS=SIGNED
+ SIGNATURE_STATUS=SLSA_PROVENANCE_GENERATED

Build-info page checks for signature_status === "SLSA_PROVENANCE_GENERATED" to display attestation links. Workflow now emits the expected value.

2. Footer Link Security

File: src/components/layout/footer.tsx

  <Link
    target="_blank"
+   rel="noopener noreferrer"
    href="/build-info"

Prevents window.opener access for links opening in new tabs.

3. Interactive Elements Fix

File: src/app/(public)/build-info/page.tsx

Refactored 4 button/anchor combinations using Button's asChild prop:

Before:

<a href="..." target="_blank" rel="noopener noreferrer">
  <Button variant="outline" size="sm">
    View on GitHub
  </Button>
</a>

After:

<Button variant="outline" size="sm" asChild>
  <a href="..." target="_blank" rel="noopener noreferrer">
    View on GitHub
  </a>
</Button>

Button now renders as the anchor using Radix UI Slot. Applied to: Source Code, Build Logs, Attestations, Security Scorecard.

Version Bump

• Version automatically bumped by workflow (same-repo PRs)
• Version manually bumped using node scripts/bump-version.js (fork PRs)
• Version already up-to-date (no bump needed)

Testing

Test Environment

• Node version: 20.19.0
• npm version: 11.x
• OS: Linux

Tests Performed

• Unit tests pass (npm run test)
• E2E tests pass (npm run test:e2e)
• Linting passes (npm run lint)
• Manual testing completed

Test Coverage

• ESLint validation on changed files
• CodeQL security scan (0 vulnerabilities)
• HTML validity improvements verified

Documentation

• Documentation updated (if needed)
• Code comments added for complex logic
• API documentation updated (if API changes)

Checklist

• My code follows the project's code style
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Screenshots (if applicable)

N/A - No visual changes, structural improvements only

Additional Notes

• Tailwind CSS syntax unchanged per review requirements
• package-lock.json updated with peer dependency markers from npm install
• Changes maintain existing visual appearance and functionality

---

For maintainers:

• PR title follows conventional commit format
• Version bump is correct
• All checks pass
• Documentation is complete
• Ready to merge

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• fonts.googleapis.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/GhostClass/GhostClass/node_modules/.bin/next build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR addresses three unresolved review comments from PR #398 by fixing a signature status mismatch, adding a missing security attribute, and correcting nested interactive elements. The changes improve build transparency, security, and HTML validity without altering visual appearance.

Changes:

• Fixed signature status value in release workflow to match UI expectations (SIGNED → SLSA_PROVENANCE_GENERATED)
• Added rel="noopener noreferrer" security attribute to footer's build-info link opening in new tab
• Refactored 4 button/anchor combinations using Button's asChild prop to avoid nested interactive elements

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/release.yml	Changed SIGNATURE_STATUS build arg from SIGNED to SLSA_PROVENANCE_GENERATED to match UI check
src/components/layout/footer.tsx	Added rel="noopener noreferrer" to Link component for security when target="_blank"
src/app/(public)/build-info/page.tsx	Refactored 4 button/anchor combinations using asChild pattern to eliminate nested interactive elements
package-lock.json	Added/removed peer dependency markers from npm install (metadata only)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.