fix: harden path validation and consumer guides

[jbdevprimary]

Summary

• replace nested path regex recognition with linear-time portable validation and regression coverage
• raise GitPython minimum to the remediated 3.1.58 floor and refresh the lock to 3.1.59
• make the root README and Sourcey navigation a practical entry point for human and agentic consumers
• add executable checks for the public quickstarts

Validation

• tox -e lint,typecheck
• tox -e py311,py312,py313,py314 (812 passed per interpreter; 95% total coverage)
• tox -e examples,docs,build,audit
• pnpm --dir docs validate (62 Sourcey pages)
• actionlint .github/workflows/*.yml

[coderabbitai]

Warning

Review limit reached

Next included review available in 20 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ddc64fc9-6e3e-4e22-81ea-72f4437a33de

📥 Commits

Reviewing files that changed from the base of the PR and between 8bde20b and 4768053.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

• README.md
• docs/guides/agentic-consumers.md
• docs/sourcey.config.ts
• packages/extended-data/pyproject.toml
• packages/extended-data/src/extended_data/primitives/types.py
• packages/extended-data/tests/core/test_type_utils.py
• packages/extended-data/tests/examples/test_safe_examples.py
• packages/pytest-extended-data/README.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[amazon-q-developer]

The path validation hardening and dependency updates look solid. The replacement of the nested regex with linear-time bounded validation effectively mitigates ReDoS risks. The GitPython dependency bump to 3.1.58 addresses known vulnerabilities. Test coverage is comprehensive with good edge case handling including adversarial inputs.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud