Fix release blockers and deployment build

apps/sources/services/discovery.py

@@ -4,11 +4,11 @@ import ipaddress
 import json
 import re
 from dataclasses import dataclass
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from urllib.parse import urljoin, urlsplit
-from xml.etree import ElementTree
 
 from bs4 import BeautifulSoup
+from defusedxml import ElementTree
 from django.db import transaction
 
 from apps.sources.adapters.email_alert import EmailAlertAdapter
@@ -166,15 +166,14 @@ def persist_discovery_candidates(candidates: list[SourceCandidate]) -> tuple[int
             evidence = metadata.get("discovery", [])
             if not isinstance(evidence, list):
                 evidence = []
-            if not any(item.get("url") == candidate.url for item in evidence if isinstance(item, dict)):
+            if not any(
+                item.get("url") == candidate.url for item in evidence if isinstance(item, dict)
+            ):
                 evidence.append(provenance)
                 metadata["discovery"] = evidence[-20:]
                 metadata["discovered_at"] = now
                 source.metadata = metadata
                 updated_fields.append("metadata")
-            else:
-                skipped += 1
-
             if not source.name:
                 source.name = _candidate_name(candidate)
                 updated_fields.append("name")
@@ -223,19 +222,24 @@ def _discover_html(
 
     for anchor in soup.find_all("a", href=True):
         label = " ".join(anchor.get_text(" ", strip=True).split())
+        raw_url = urljoin(base_url, str(anchor["href"]))
+        candidate_host = _hostname(raw_url)
+        same_domain = bool(base_domain and domain_matches(candidate_host, base_domain))
         candidate = _build_candidate(
-            raw_url=urljoin(base_url, str(anchor["href"])),
+            raw_url=raw_url,
             base_domain=base_domain,
             source_type=Source.Type.EMPLOYER,
             label=label,
             reason="career-link",
             discovered_from="html",
-            confidence=0.9,
-            allow_off_domain=False,
+            confidence=0.9 if same_domain else 0.7,
+            allow_off_domain=True,
         )
         if not candidate:
             continue
-        if not CAREER_PATTERN.search(label) and not CAREER_PATTERN.search(urlsplit(candidate.url).path):
+        if not CAREER_PATTERN.search(label) and not CAREER_PATTERN.search(
+            urlsplit(candidate.url).path
+        ):
             continue
         candidates.append(candidate)
 
@@ -388,4 +392,4 @@ def _to_domain_root_url(url: str) -> str:
 
 
 def _utc_now() -> str:
-    return datetime.now(timezone.utc).isoformat()
+    return datetime.now(UTC).isoformat()