ci: run the offline lychee link check

[kyle-sexton]

No related issue: part of the org-wide lychee rollout that makes a broken local link or anchor block merge.

Summary

Adds an Offline links job to pr-require-checks.yml and feeds it into ci-status, the context the org ci-gate ruleset requires on the default branch.

Fix

• New lychee job runs the pinned melodic-software/ci-workflows lychee-offline composite (v0.39.8) against the synced lychee.toml, offline, over **/*.md.
• ci-status now needs the job; its aggregation passes needs.*.result with treat-skipped-as: fail, so a red or skipped lychee job fails ci-status.
• Keeps the existing relative-link job: lychee's **/*.md glob skips dot-directories, which that job's git ls-files walk covers. Adds a SC2016 disable for its intentional single-quoted backticks so actionlint passes.
• The AGENTS.md CI section names the new check.

Verification

• Local: lychee 0.24.2 --offline --config lychee.toml '**/*.md' reports 0 errors.
• CI: the Offline links job on this PR runs on Linux, which also catches case-sensitive path mismatches.

Related

• Shared ruleset: lychee.toml, synced from melodic-software/standards (not edited here).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T14:39:47.842983Z	3e30ee5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 1m 1s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Understand the request (/review:security-review lane)
• Review .github/workflows/pr-require-checks.yml changes
• Review AGENTS.md changes
• Check for instruction-surface deletions
• Post findings

No security issues found.

This PR is CI-config and documentation only:

• .github/workflows/pr-require-checks.yml adds a new lychee job that checks out the PR head with persist-credentials: false and runs the pinned, offline lychee-offline composite against lychee.toml. The workflow's only permissions: block remains the single top-level contents: read (confirmed no job, including the new one, adds its own permissions: key), so the new job introduces no privilege escalation, no secrets usage, and no write access. It runs on pull_request (not pull_request_target), offline, over local Markdown files only — no untrusted network fetch, no injection of PR-controlled data into a run: shell block beyond the pre-existing, unchanged if: predicate copied verbatim from sibling jobs.
• AGENTS.md only adds a description of the new check; it doesn't remove or weaken any existing guardrail or instruction, so the instruction-surface-deletion lens doesn't apply here.
• GitHub Actions hardening concerns (action pinning, trigger choice, permissions: widening) are zizmor's advisory lane per this skill's scope and are not re-reported here; nothing in this diff needed the logic/trust-boundary reasoning that would make an Actions finding this lane's to raise anyway.

[claude]

Claude finished @kyle-sexton's task in 4m 4s —— View job

---

Code review — /review:code-review

• Gather context (PR diff, changed files)
• Review .github/workflows/pr-require-checks.yml changes
• Review AGENTS.md changes
• Check alignment with CLAUDE.md/AGENTS.md/REVIEW.md criteria
• Post findings

No blocking findings. The change is small, scoped, and consistent with the existing workflow conventions:

• The new lychee job's if: predicate is byte-identical to the other five lanes' contract-only predicate (verified with a diff across all six occurrences in the file) — satisfies the "verbatim" rule in AGENTS.md's doc conventions.
• ci-status's needs: list is correctly updated to include lychee, so a red or skipped lychee run fails the required ci-status gate via the existing treat-skipped-as: fail aggregation — no separate wiring needed.
• Both actions/checkout and the lychee-offline composite are pinned to full 40-character commit SHAs (org requirement), and the composite's SHA (594987ab...) matches the one already pinned for the typos action a few lines down — same release, consistent trust level, nothing newly vetted.
• lychee.toml exists at the repo root and is referenced correctly (config: lychee.toml), matching the typos job's config: _typos.toml pattern.
• The retained check-links job plus the new lychee job's coexistence rationale (dot-directory glob skip vs. anchor/reference-link coverage) is accurate and non-redundant.
• The added # shellcheck disable=SC2016 sits directly above the entire outer while loop (not just the next physical line), which is how shellcheck/actionlint directives scope to compound statements — it covers the nested sed line with the literal backticks further down, as intended.
• AGENTS.md's CI section update accurately describes the new check and reads consistently with the surrounding prose.
• Independently confirmed via mcp__github_ci: workflow run 38147797426 shows the new Offline links job, plus ci-status, both completed with success on this PR's head SHA — this is my own tool-verified confirmation, not a restatement of the PR's claimed verification (which I did not independently reproduce locally, e.g. running lychee --offline myself).

Minor (non-blocking) style note: the new lychee job uses runs-on: ubuntu-24.04 + explicit timeout-minutes: 15, while the other four pre-existing lanes (test-shell, psscriptanalyzer, validate-manifests, check-links) use bare ubuntu-latest with no timeout. This matches ci-status's own style rather than the other lanes' — purely cosmetic, not something a linter or this lane's high-signal bar would block on.

[github-actions]

claude-security-review has reviewed this pull request through 3e30ee5; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through 3e30ee5; a later push is reviewed from there.