Export publiccode.yml directly to a code repository

[valeriocomo]

Context

Derived from requirement RF-PCE-003

Scope

Today the only ways out of the editor are "copy to clipboard" and "download
publiccode.yml", both in YamlPreview. From there the user has to find their
repository, create or open the file, and paste. Close that gap: let the editor hand the
generated YAML straight to the code hosting platform.

The mechanism is deliberately link-based — the platform's own edit file page, prefilled
with the generated content — not an authenticated API call:

• GitHub: /<owner>/<repo>/new/<branch>?filename=publiccode.yml&value=<content> for a
  new file, /edit/<branch>/publiccode.yml for an existing one.
• GitLab: the equivalent /-/new/<branch> and /-/edit/<branch>/<path> routes.

The user stays in their own authenticated session on the platform, reviews the diff
there, and commits. Nothing is written on their behalf.

This choice is what keeps the requirement compatible with the app's architecture: the
editor is a static SPA with no back-end, so it has nowhere to keep an OAuth secret or a
token. A link-based export keeps it that way.

The import side already knows how to turn a platform web URL into something actionable
(gitlab-url-adapter.ts parses a GitLab web URL into an API URL). This is the same
translation in reverse, and the two should end up sharing their understanding of what a
repository URL looks like.

Affected areas

• src/app/components/YamlPreview.tsx — the toolbar that currently holds copy /
  upload / download; the new action belongs alongside them.
• New src/app/exporters/ module, mirroring the existing src/app/importers/
  structure (file.importer.ts, gitlab.importer.ts, standard.importer.ts), with one
  exporter per supported platform.
• src/app/importers/gitlab-url-adapter.ts — the URL parsing to build on; consider
  extracting the shared part rather than duplicating it.
• src/app/is-valid-url.ts — existing URL validation helper, to reuse instead of adding
  a second one.
• src/i18n/locales/*.json — strings for the new action.

Non-functional constraints

• RNF-PCE-001 — Security (OWASP Top 10): the destination URL comes from the user, so
  this is an open-redirect surface. Validate scheme and host against the supported
  platforms before navigating, and never interpolate unescaped content into the URL.
  Note also that prefilling via query string has a practical length limit, so the
  behaviour when a publiccode.yml exceeds it must be defined rather than silently
  truncating.
• RNF-PCE-004 — Standards and compliance: the editor must not acquire a dependency
  on a third-party service without an open source implementation. Supporting GitLab
  (self-hostable) alongside GitHub keeps a fully open source path available, and matters
  for public administrations running their own instance.

Acceptance criteria

• From the preview panel the user can send the generated YAML to a repository's file
  edit page, prefilled, on at least GitHub and GitLab
• Self-hosted GitLab instances work, not only gitlab.com
• Both cases are handled: the file does not exist yet, and it already does
• The destination URL is validated before navigation; unsupported or malformed hosts
  are refused with a clear message
• Defined, non-silent behaviour when the content is too large to prefill by URL
• No credentials, tokens or back-end involved; the app remains a static SPA
• URL-building logic covered by unit tests, in the style of
  gitlab-url-adapter.spec.ts
• New strings translated in every supported locale

Related

• Add new localisations #647 — new locales; the strings added here need to land there too