ci: scan and check links in the verify job

[altaywtf]

Summary

Moves the secret and workflow scan and the Markdown link check into the verify job as the shared actions/scan and actions/links steps (v1.2.0), and deletes the Scan and Links caller workflows.

Event	Jobs before	Jobs after
Pull request	Verify, Links, Gitleaks, TruffleHog (+ Actionlint, Zizmor when .github/ changes)	Verify
main push	Verify, Links, release	Verify, release
Weekly schedule	Gitleaks, TruffleHog, Actionlint, Zizmor	none
Manual dispatch	Scan's 4 jobs	Verify with a full-history scan

Verification

• actionlint and zizmor 1.30.1 report nothing; vp run verify passes.
• The links command with lychee 0.24.2 passes on this branch and exits 2 with a seeded missing file and anchor.

Notes

• On a main push the scan audits workflows with Actionlint and Zizmor only when the pushed range changes them. Gitleaks stays off for this public repository, which relies on GitHub secret scanning and push protection.
• Concurrency moves to the workflow and cancels only superseded pull-request runs; main runs queue so each pushed range is scanned. Distribution says so.
• Merging runs CI on main: verify and the semantic-release job, which publishes nothing for a ci: commit.

---

Written by an agent (Claude Code, Claude Opus 5.5)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It restructures release-gating CI and concurrency behavior on main, a publishing-critical path that warrants final human review despite no defects found.

Review effort: Balanced
Findings: None

What changed in this PR

This PR consolidates CI checks for the taizn Tizen packaging harness. It folds the previously standalone Scan (Gitleaks/TruffleHog/Actionlint/Zizmor) and Links (offline Markdown link/anchor) caller workflows into two shared-action steps at the end of the existing verify job in ci.yml, deletes those two workflows, adds a workflow_dispatch trigger, and moves concurrency from the job to the workflow (cancelling only superseded pull-request runs while letting main runs queue). Documentation in DISTRIBUTION.md is updated to describe the new flow.

Changes:

• Add links and scan shared actions (putdotio/.github@…v1.2.0) as steps in the verify job, with the scan step guarded by if: ${{ !cancelled() }}.
• Delete .github/workflows/scan.yml and .github/workflows/links.yml; add workflow_dispatch and workflow-level concurrency (cancel-in-progress only for pull requests).
• Update docs/DISTRIBUTION.md to describe the consolidated verify-job checks and the new concurrency/queueing behavior.

File	Description
.github/​workflows/​ci.yml	Adds workflow_dispatch, workflow-level concurrency, and links/scan steps in verify; removes job-level concurrency.
.github/​workflows/​scan.yml	Deleted; scan behavior moved into the verify job.
.github/​workflows/​links.yml	Deleted; link check moved into the verify job.
docs/​DISTRIBUTION.md	Updates CI narrative to reflect consolidated checks and queue/cancel behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[putio-ci]

🎉 This PR is included in version 2.4.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀