ci: run the scan and link check in verify

[altaywtf]

Summary

The secret and workflow scan and the Markdown link check now run as the last steps of Verify SDK instead of in their own workflows.

Jobs	Before	After
Per pull request	Verify, 5 compatibility, result, Links, Gitleaks, TruffleHog (+ Actionlint, Zizmor when .github/ changes)	Verify, 5 compatibility, result
Per push to main	the above, release, Links	the above, release
Weekly schedule	4 scan jobs	none

• Uses actions/links and actions/scan from putdotio/.github v1.2.0, pinned by commit. Links runs on every event; the scan passes through pull requests and runs on pushes and manual dispatch, which CI now accepts. The release job stays push-only.
• Public repository: Gitleaks does not run; GitHub secret scanning and push protection are on.
• Merging starts CI on main: verify, the compatibility matrix, then semantic-release, which releases nothing for a ci: commit.

Verification

• pnpm exec vp run verify, actionlint, and zizmor clean.
• The links action's command passes on this branch and fails on a seeded broken link.

---

Written by an agent (Claude Code, Claude Opus 5.5)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It restructures the security-scanning and release-gating pipeline (dropping PR-time Actionlint/Zizmor and the weekly scheduled scan, and coupling link/scan results to release gating), which warrants human review of the security posture tradeoffs.

Review effort: Balanced
Findings: 1

Open (1)

• Run link checks even when verify fails · New

What changed in this PR

This PR consolidates two separate CI workflows into the main ci.yml pipeline. The secret/workflow scan and the offline Markdown link check previously ran as their own scan.yml and links.yml workflows; they are now appended as steps at the end of the Verify SDK job using the shared putdotio/.github composite actions (actions/links and actions/scan, pinned to c1830f7… / v1.2.0). A workflow_dispatch trigger is added so the scan can be run manually, and the docs are updated to describe the new wiring.

Changes:

• Add actions/links (every event) and actions/scan (push/dispatch only, !cancelled()-guarded) as steps in the verify job, and add a workflow_dispatch trigger.
• Delete the standalone scan.yml (incl. its weekly schedule) and links.yml workflows.
• Update docs/DISTRIBUTION.md to reflect that the checks now run inside verify and that secret coverage relies on GitHub native secret scanning for this public repo.

File	Description
.github/​workflows/​ci.yml	Adds workflow_dispatch and runs the shared links/scan actions as final steps of the verify job.
.github/​workflows/​scan.yml	Removed; its secret/workflow scan (and weekly schedule) now lives in the verify job.
.github/​workflows/​links.yml	Removed; the Markdown link check now runs in the verify job.
docs/​DISTRIBUTION.md	Documents the new in-verify link/scan steps and the public-repo secret-scanning posture.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[putio-ci]

🎉 This PR is included in version 13.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀