From 468ad2305518c02478cafcd72641aa0e29e3a860 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 31 Oct 2026 12:59:28 -0400 Subject: [PATCH 1/4] Links workflow: cancel superseded runs, name the job - Clears the two open zizmor notes (concurrency-limits, anonymous-definition) on the repo's only CI workflow --- .github/workflows/links.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/links.yaml b/.github/workflows/links.yaml index cd69b060d8..dfe2c384f2 100644 --- a/.github/workflows/links.yaml +++ b/.github/workflows/links.yaml @@ -10,9 +10,13 @@ on: workflow_dispatch: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true jobs: check-links: + name: Check links runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 From 990b169abeecb59f5bed1cb2f3d282ecee268075 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 31 Oct 2026 13:58:40 -0400 Subject: [PATCH 2/4] Links workflow: say why github.ref; match the check name in CONTRIBUTING - r1.1 and r1.3 of docsy-example#533's conducted review cycle --- .github/workflows/links.yaml | 2 ++ CONTRIBUTING.md | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/links.yaml b/.github/workflows/links.yaml index dfe2c384f2..84f6b0c263 100644 --- a/.github/workflows/links.yaml +++ b/.github/workflows/links.yaml @@ -10,6 +10,8 @@ on: workflow_dispatch: permissions: contents: read +# github.ref: a newer run of the same ref supersedes the one in progress; this +# workflow only checks, so nothing is lost by cancelling. concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e3c7889e5d..c0c692801b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -60,7 +60,7 @@ result. The manifests declare no lifecycle hooks (guarded by so its CI still evaluates the allowlist; this repo's `install:safe` has no such step. - With the key set, a lock-synced hugo-extended bump with no approval would - arrive with a green `check-links`. + arrive with a green `Check links`. - The Netlify build is script-free (`install:safe`) and then runs `hugo`, whose wrapper self-installs the pinned binary: that path checks no approval here (Docsy's does, through its rebuild step). From 545d191d9e3cf6c9d6788fde7d283fc3f8551cae Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 31 Oct 2026 14:05:02 -0400 Subject: [PATCH 3/4] Links workflow: header names all three guards --- .github/workflows/links.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/links.yaml b/.github/workflows/links.yaml index 84f6b0c263..49d8f89e69 100644 --- a/.github/workflows/links.yaml +++ b/.github/workflows/links.yaml @@ -1,4 +1,5 @@ -# Build the example site and check links with Lychee. +# Build the example site, check its links with Lychee, and guard the npm-script +# posture and the committed generated files. # cSpell:ignore lycheeverse name: links From 4eed514ac180c28a7fbfd6cebc8cae3ac7b69b20 Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 31 Oct 2026 14:32:47 -0400 Subject: [PATCH 4/4] Links workflow: say what the github.ref key does on main --- .github/workflows/links.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/links.yaml b/.github/workflows/links.yaml index 49d8f89e69..9493faf0c6 100644 --- a/.github/workflows/links.yaml +++ b/.github/workflows/links.yaml @@ -11,8 +11,8 @@ on: workflow_dispatch: permissions: contents: read -# github.ref: a newer run of the same ref supersedes the one in progress; this -# workflow only checks, so nothing is lost by cancelling. +# github.ref: a newer push to main cancels the run in progress too; this +# workflow only checks, so nothing is lost. concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true