ci: scan and check links in the verify job

[altaywtf]

Summary

Moves the secret and workflow scan and the Markdown link check into the verify job as the shared actions/scan and actions/links steps (v1.2.0), and deletes the Scan and Links caller workflows.

Event	Jobs before	Jobs after
Pull request	Verify, Links, Gitleaks, TruffleHog (+ Actionlint, Zizmor when .github/ changes)	Verify
main push	Verify, Links, release	Verify, release
Weekly schedule	Gitleaks, TruffleHog, Actionlint, Zizmor	none
Manual dispatch	Scan's 4 jobs	Verify with a full-history scan

Risks

• On a main push the scan audits workflows with Actionlint and Zizmor only when the pushed range changes them. Gitleaks stays off for this public repository, which relies on GitHub secret scanning and push protection.
• Concurrency moves to the workflow and cancels only superseded pull-request runs; main runs queue so each pushed range is scanned.
• Merging runs CI on main: verify and the semantic-release job, which publishes nothing for a ci: commit.

Verification

• actionlint and zizmor 1.30.1 report nothing; vp run verify passes.
• The links command with lychee 0.24.2 passes on this branch and exits 2 with a seeded missing file and anchor.

Follow-Ups

None.

---

Written by an agent (Claude Code, Claude Opus 5.5)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It alters CI security-scanning coverage and release-adjacent workflow wiring, so the disclosed security tradeoffs warrant final human review.

Review effort: Balanced
Findings: None

What changed in this PR

This PR consolidates CI security scanning and Markdown link checking into the existing verify job of .github/workflows/ci.yml, replacing the two standalone caller workflows (scan.yml, links.yml) with the shared actions/links and actions/scan composite actions (pinned to v1.2.0). It also restructures concurrency from the job level to the workflow level and adds a workflow_dispatch trigger so a full-history scan can be run manually.

I confirmed that putdotio/.github is public, so the scan action's Zizmor online audit works under the job's contents: read token, and that the action only performs workflow audits on push/workflow_dispatch (not on pull requests) per its plan.sh — consistent with the PR description. The behavior reductions (no PR-time workflow audit, no weekly scheduled scan, TruffleHog dropped) are intentional and disclosed in the PR's Risks section.

Changes:

• Add actions/links and actions/scan steps to the verify job; the scan step uses if: ${{ !cancelled() }} so it still runs after an earlier failure.
• Move concurrency to the workflow level (cancel-in-progress only for pull requests) and add a workflow_dispatch trigger; delete scan.yml and links.yml.
• Update docs/DISTRIBUTION.md to describe the new inline links/scan steps.

File	Description
.github/​workflows/​ci.yml	Adds links/scan steps to verify, moves concurrency to workflow level, adds workflow_dispatch.
.github/​workflows/​scan.yml	Deleted; scanning now runs inline via the shared scan action.
.github/​workflows/​links.yml	Deleted; link checking now runs inline via the shared links action.
docs/​DISTRIBUTION.md	Documents the new inline links and scan steps in the verify job.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.