[altaywtf]

Moves the secret and workflow scan and the Markdown link check into the verify job as the shared actions/scan and actions/links steps (v1.2.0), and deletes the Scan and Links caller workflows.

• Jobs removed: 3–5 per pull request (Links, Gitleaks, TruffleHog, plus Actionlint and Zizmor when .github/ changes), 1 per main push (Links), and the weekly 4-job scan.
• On a main push the scan audits workflows with Actionlint and Zizmor when the pushed range changes them; the new workflow_dispatch trigger scans full history. Gitleaks stays off for this public repository, which relies on GitHub secret scanning and push protection.
• Concurrency moves to the workflow and cancels only superseded pull-request runs; main runs queue so each pushed range is scanned.
• Local checks: actionlint and zizmor 1.30.1 report nothing; the links command with lychee 0.24.2 passes on this branch and exits 2 with a seeded missing file and anchor. Distribution describes the new steps.
• Merging runs CI on main: verify and the semantic-release job, which publishes nothing for a ci: commit.

---

Written by an agent (Claude Code, Claude Opus 5.5)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It alters the npm publishing pipeline's concurrency and gating and deletes the standalone Scan/Links workflows, which may be referenced as required status checks in branch protection that cannot be verified here.

Review effort: Balanced
Findings: 1

Open (1)

• Links step is skipped when verify fails · New

What changed in this PR

This PR consolidates the separate Scan and Links CI workflows into the existing verify job in ci.yml, using the shared actions/links and actions/scan composite actions (pinned to v1.2.0) from putdotio/.github. It reduces the number of per-PR jobs, drops the weekly scheduled scan, and reworks concurrency so that pull-request runs cancel superseded runs while main pushes queue (protecting in-flight releases). Documentation in DISTRIBUTION.md is updated to describe the new steps.

Changes:

• Moved the Markdown link check and secret/workflow scan into the verify job as steps; added a workflow_dispatch trigger.
• Replaced per-job concurrency groups with a single workflow-level group that only cancels in-progress runs for pull requests.
• Deleted scan.yml and links.yml caller workflows and updated DISTRIBUTION.md.

File	Description
.github/​workflows/​ci.yml	Adds workflow_dispatch, workflow-level concurrency, and link/scan steps to the verify job; removes per-job concurrency blocks.
.github/​workflows/​scan.yml	Deleted; scan behavior folded into the verify job (weekly schedule dropped).
.github/​workflows/​links.yml	Deleted; link check folded into the verify job.
docs/​DISTRIBUTION.md	Updates the distribution docs to describe the shared links/scan steps in verify.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[putio-ci]

🎉 This PR is included in version 5.0.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀