ci: auto-sort and validate systems.csv on PRs

[fredericsimard]

What

Adds automated checks that run on every pull request that changes systems.csv, plus a data sort so the catalog starts in a sorted state.

New workflow: .github/workflows/systems_csv_pr_checks.yml

Job	Behavior
sort	Re-sorts systems.csv and pushes the result back to the PR branch as a separate chore: sort systems.csv commit. Same-repo branches only — fork PRs are skipped (the default GITHUB_TOKEN cannot push to forks).
validate-structure	Fails on malformed rows (wrong field count / broken quoting) and empty required columns (Country Code, Name, Location, System ID, URL, Auto-Discovery URL). Empty Supported Versions → warning; the 3 Authentication columns are optional. Emits inline PR annotations.
check-new-urls	For URLs newly added by the PR (both URL and Auto-Discovery URL columns), follows redirects and requires a final HTTP 200–299. Pre-existing URLs are ignored.

New scripts (scripts/)

• sort-systems-csv.sh — mirrors the canonical (head -n 1; LC_ALL=en_US.UTF-8 sort -t, -k1,1 -k2,2) < systems.csv. Supports --check and a GNUSORT=gsort override for macOS.
• validate-systems-csv.js — structure validator (Node, no deps).
• check-new-urls.js — new-URL HTTP checker (Node, no deps; retries once on transient network errors).

Other changes

• chore: sort systems.csv — applies the sort now (3 rows reordered).
• README.md — the "keep this list alphabetized" note now explains the automated sort in plain and technical terms, with local-repro instructions.

Notes / decisions

• Fork PRs: auto-sort commit is skipped (can't push to forks); structure and URL checks still run.
• URL check covers both URL columns per request; operator homepages occasionally return 403/429 to CI bots, which would fail a PR — worth watching in practice.

Test evidence (local)

• Sort: idempotent; --check correctly flags unsorted input.
• Structure: current file passes with 1 warning (empty Supported Versions); synthetic malformed rows correctly flagged.
• URL check: pre-existing URLs ignored, new URLs from both columns checked, passes on 2xx / fails on non-2xx.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ fredericsimard
❌ github-actions[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

Addressed by subsequent commits

Pull request overview

Adds automated pull-request checks around systems.csv to keep the catalog consistently sorted and to validate new/changed entries, with supporting scripts and contributor documentation updates.

Changes:

• Introduces a new PR workflow to auto-sort systems.csv, validate CSV structure/required fields, and HTTP-check newly added URLs.
• Adds three new helper scripts under scripts/ to implement sorting, structural validation, and new-URL checking.
• Applies an initial sort to systems.csv and updates README contributor guidance with local reproduction instructions.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
systems.csv	Reorders a handful of rows to match the new canonical sort order.
scripts/validate-systems-csv.js	Adds a Node-based structure/required-field validator emitting GitHub Actions annotations.
scripts/sort-systems-csv.sh	Adds an in-repo canonical sort implementation (header preserved; GNU sort keys).
scripts/check-new-urls.js	Adds a Node-based checker that verifies newly introduced URLs return final 2xx after redirects.
README.md	Updates contributor instructions to describe the automated sort and local reproduction steps.
.github/workflows/systems_csv_pr_checks.yml	New workflow wiring sorting + validation + URL checks on PRs touching systems.csv.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

scripts/check-new-urls.js:163

• The SSRF guard can be bypassed via DNS rebinding: hostIsSafe() resolves the hostname and checks the returned IPs, but http(s).request() will do its own DNS lookup at connection time (which may return a different/private address). Add a lookup option to the request that validates the resolved address with isBlockedIp() before connecting, so the safety check is enforced at the actual socket connection step as well.

      {
        method: 'GET',
        headers: { 'User-Agent': USER_AGENT, Accept: '*/*' },
        timeout: TIMEOUT_MS,
      },