ci: scan and check links in the verify job

[altaywtf]

Moves the secret and workflow scan and the Markdown link check into the verify job as the shared actions/scan and actions/links steps (v1.2.0), and deletes the Scan and Links caller workflows.

• Jobs removed: 3–5 per pull request (Links, Gitleaks, TruffleHog, plus Actionlint and Zizmor when .github/ changes), 1 per main push (Links), and the weekly 4-job scan.
• On a main push the scan audits workflows with Actionlint and Zizmor when the pushed range changes them; the new workflow_dispatch trigger scans full history. Gitleaks stays off for this public repository, which relies on GitHub secret scanning and push protection.
• Concurrency moves to the workflow and cancels only superseded pull-request runs; main runs queue so each pushed range is scanned.
• Local checks: actionlint and zizmor 1.30.1 report nothing; the links command with lychee 0.24.2 passes on this branch and exits 2 with a seeded missing file and anchor. Distribution describes the new steps.
• Merging runs CI on main: verify and the semantic-release job, which publishes nothing for a ci: commit.

---

Written by an agent (Claude Code, Claude Opus 5.5)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It alters security-scanning cadence (drops the weekly scheduled scan) and release-pipeline concurrency while depending on external shared actions whose permission needs can't be verified here, warranting human sign-off.

Review effort: Balanced
Findings: None

What changed in this PR

This PR consolidates the repository's security/workflow scanning and Markdown link checking into the existing verify job of ci.yml, using the shared actions/links and actions/scan composite actions (v1.2.0) from putdotio/.github. It removes the two standalone caller workflows (scan.yml, links.yml), reducing the number of jobs per run, and reworks concurrency to a single workflow-level group that only cancels superseded pull-request runs while letting main pushes queue. The DISTRIBUTION.md doc is updated to describe the new behavior.

Changes:

• Add the shared links and scan actions as the final steps of the verify job (scan runs with if: ${{ !cancelled() }}); add a workflow_dispatch trigger.
• Replace per-job concurrency blocks with one workflow-level concurrency group that cancels in-progress runs only for pull_request events.
• Delete scan.yml and links.yml and update docs/DISTRIBUTION.md accordingly.

File	Description
.github/​workflows/​ci.yml	Moves scan/links into verify, adds workflow_dispatch, and centralizes concurrency at the workflow level.
.github/​workflows/​scan.yml	Removed; its scheduled/PR/dispatch scan is replaced by the inline scan step.
.github/​workflows/​links.yml	Removed; its link check is replaced by the inline links step.
docs/​DISTRIBUTION.md	Updates the distribution notes to reference the new shared links/scan steps.

Observations (not blocking): The Scan step runs with if: ${{ !cancelled() }} so it always executes, while the Check Markdown links step has no guard and is therefore skipped whenever vp run verify fails. This asymmetry is plausibly intentional (security scan should always run), so I did not flag it as a defect. I also confirmed no stale references to the removed workflows remain (the README badge points only to ci.yml), and the new action refs follow the repo's SHA-pinning convention.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[putio-ci]

🎉 This PR is included in version 3.0.4 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀