ci: run the scan and link check in verify

[altaywtf]

The secret and workflow scan and the Markdown link check now run as the last steps of CI's Verify Roku app job, and Release calls that job instead of keeping its own copy.

Jobs	Before	After
Per pull request	Verify, Links, Gitleaks, TruffleHog (+ Actionlint, Zizmor when .github/ changes)	Verify
Per push to main	Verify, Publish, Links (+ Deploy on a release)	Verify, Publish (+ Deploy on a release)
Weekly schedule	4 scan jobs	none

• Push-time home: release.yml already runs on every main push and gates semantic-release on verify, so its verify job now calls ci.yml through workflow_call. CI keeps one trigger per job (pull requests, plus manual dispatch for the full-history scan with no release side effects), and the push scan runs inside the release run with the push range. This also drops the duplicated verify job definition.
• Uses actions/links and actions/scan from putdotio/.github v1.2.0, pinned by commit. CI concurrency now cancels only pull-request runs.
• Public repository: Gitleaks does not run; GitHub secret scanning and push protection are on.
• Merging starts Release on main: verify through CI, then semantic-release, which releases nothing for a ci: commit, so the deploy job stays skipped.
• Checks: pnpm verify, actionlint, and zizmor clean; the links action's command passes on this branch and fails on a seeded broken link.

---

Written by an agent (Claude Code, Claude Opus 5.5)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It restructures the release/CI pipeline and removes the Scan/Links workflows, so a human should confirm no branch-protection required status checks still reference the removed workflow names before merging.

Review effort: Balanced
Findings: None

What changed in this PR

This PR consolidates CI so the Markdown link check and the secret/workflow scan run as the final steps of CI's single Verify Roku app job instead of as separate Links and Scan workflows. It replaces the two standalone workflows with the shared composite actions putdotio/.github/.github/actions/{links,scan}@v1.2.0, and rewires release.yml's verify job to call ci.yml via workflow_call so a main push runs verification (and the push-range scan) inside the release run. Documentation (AGENTS.md, CONTRIBUTING.md, docs/RELEASE.md) is updated to match the new topology.

Changes:

• Add workflow_call + workflow_dispatch triggers to ci.yml, scope cancel-in-progress to pull-request runs only, and append the links and scan steps (scan guarded by !cancelled()).
• Delete links.yml and scan.yml; release.yml's verify job now uses: ./.github/workflows/ci.yml, dropping the duplicated job definition.
• Update three docs to describe the new CI/Release flow, pointing at the shared actions.

File	Description
.github/​workflows/​ci.yml	Adds workflow_call/workflow_dispatch triggers, PR-only cancel, and links/scan steps as the final verify steps.
.github/​workflows/​release.yml	Verify job now calls ci.yml via workflow_call instead of defining its own steps.
.github/​workflows/​scan.yml	Removed; scanning moved into CI's verify job via the shared action.
.github/​workflows/​links.yml	Removed; link checking moved into CI's verify job via the shared action.
AGENTS.md	Rewords Delivery bullets to describe the shared links/scan steps and new flow.
CONTRIBUTING.md	Updates CI/Delivery description to the consolidated CI job and release call.
docs/​RELEASE.md	Clarifies that main pushes run the same CI job from the release workflow and scan the pushed range.

I verified: the pinned SHA c1830f7… matches tag v1.2.0; the scan action passes through on pull requests, scans the range on push (which reaches ci.yml as github.event_name == 'push' through workflow_call), and self-deepens the persist-credentials: false shallow checkout with contents: read; the !cancelled() guard and PR-only cancel-in-progress match the shared action's documented requirements; the #actionsscan/#actionslinks anchors exist; and no remaining references to the deleted workflows exist in the repo.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.