ci: scan and check links in the verify job

.github/workflows/ci.yml

@@ -5,18 +5,20 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   verify:
     if: github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]')
     name: Verify package
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 20
-    concurrency:
-      group: verify-${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: true
     permissions:
       contents: read
 
@@ -40,14 +42,18 @@ jobs:
       - name: Verify repository
         run: vp run verify
 
+      - name: Check Markdown links
+        uses: putdotio/.github/.github/actions/links@c1830f7938b7dc98f085082e988d3c46437bb15c # v1.2.0
+
+      - name: Scan secrets and workflows
+        if: ${{ !cancelled() }}
+        uses: putdotio/.github/.github/actions/scan@c1830f7938b7dc98f085082e988d3c46437bb15c # v1.2.0
+
   verify-consumer-surface:
     if: github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]')
     name: Verify consumer surface
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 20
-    concurrency:
-      group: verify-consumer-surface-${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: true
     permissions:
       contents: read
 

docs/DISTRIBUTION.md

@@ -9,10 +9,11 @@ commit releases and how the version bumps.
 The job calls `frontend-release-npm.yml` from the shared
 [putdotio/.github workflows](https://github.com/putdotio/.github#frontend-release-npmyml),
 pinned to a reviewed commit SHA. That workflow owns the semantic-release pins, the
-release bot, and caching. [scan.yml](../.github/workflows/scan.yml) calls the
-shared scan workflow from the same repository, and
-[links.yml](../.github/workflows/links.yml) its offline Markdown link and
-anchor check on pull requests and `main`.
+release bot, and caching. The `verify` job ends with the shared
+[links](https://github.com/putdotio/.github#actionslinks) and [scan](https://github.com/putdotio/.github#actionsscan) actions from the
+same repository: an offline Markdown link and anchor check on every run, and an
+Actionlint and Zizmor audit when a `main` push changes workflows, or of the
+full history on manual dispatch.
 
 ## Release Environment