From f6d196cfa969a282b480660d0ee30636dd102a79 Mon Sep 17 00:00:00 2001
From: Altay <altay@hey.com>
Date: Mon, 5 Oct 2026 08:59:24 +0300
Subject: [PATCH] ci: scan and check links in the verify job

Replace the Scan and Links caller workflows with the putdotio/.github v1.2.0 scan and links actions as the last steps of verify. CI gains workflow_dispatch for a full-history scan, and only pull-request runs cancel when superseded.
---
 .github/workflows/ci.yml    | 15 ++++++++++++---
 .github/workflows/links.yml | 19 -------------------
 .github/workflows/scan.yml  | 19 -------------------
 docs/DISTRIBUTION.md        |  2 +-
 4 files changed, 13 insertions(+), 42 deletions(-)
 delete mode 100644 .github/workflows/links.yml
 delete mode 100644 .github/workflows/scan.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af2da64..90d8023 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,18 +5,20 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   verify:
     if: github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]')
     name: Verify rokit
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 20
-    concurrency:
-      group: verify-${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: true
     permissions:
       contents: read
 
@@ -40,6 +42,13 @@ jobs:
       - name: Verify repository
         run: vp run verify
 
+      - name: Check Markdown links
+        uses: putdotio/.github/.github/actions/links@c1830f7938b7dc98f085082e988d3c46437bb15c # v1.2.0
+
+      - name: Scan secrets and workflows
+        if: ${{ !cancelled() }}
+        uses: putdotio/.github/.github/actions/scan@c1830f7938b7dc98f085082e988d3c46437bb15c # v1.2.0
+
   release:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && !contains(github.event.head_commit.message, '[skip ci]')
     needs:
diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml
deleted file mode 100644
index 2c2f47e..0000000
--- a/.github/workflows/links.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-name: Links
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-permissions: {}
-
-concurrency:
-  group: links-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  links:
-    permissions:
-      contents: read
-    uses: putdotio/.github/.github/workflows/frontend-links.yml@1ee0d3b473cbc6fada08831f01ff80fe653c434a # v1.1.0
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
deleted file mode 100644
index 3ffcae0..0000000
--- a/.github/workflows/scan.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-name: Scan
-
-on:
-  pull_request:
-  schedule:
-    - cron: "41 6 * * 1"
-  workflow_dispatch:
-
-permissions: {}
-
-concurrency:
-  group: scan-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  scan:
-    permissions:
-      contents: read
-    uses: putdotio/.github/.github/workflows/frontend-scan.yml@8240b79dee9e0933c757bca249c82daa698d9c47 # v1.0.2
diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md
index 7969709..802e335 100644
--- a/docs/DISTRIBUTION.md
+++ b/docs/DISTRIBUTION.md
@@ -11,7 +11,7 @@ Merges to `main` are considered publishable. The CI workflow runs:
 
 semantic-release analyzes Conventional Commits; a releasable commit publishes to npm, creates a GitHub Release, and commits the released `package.json` version back to `main` with `[skip ci]`.
 
-The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a reviewed commit SHA; the semantic-release action and plugin pins live there. [`scan.yml`](https://github.com/putdotio/rokit/blob/main/.github/workflows/scan.yml) calls the shared frontend scan workflow from the same repository: Gitleaks, TruffleHog, Actionlint, and Zizmor on pull requests, weekly, and on manual dispatch. [`links.yml`](https://github.com/putdotio/rokit/blob/main/.github/workflows/links.yml) calls its offline Markdown link and anchor check on pull requests and `main`.
+The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a reviewed commit SHA; the semantic-release action and plugin pins live there. The `verify` job ends with the shared [links](https://github.com/putdotio/.github#actionslinks) and [scan](https://github.com/putdotio/.github#actionsscan) actions from the same repository: an offline Markdown link and anchor check on every run, and an Actionlint and Zizmor audit when a `main` push changes workflows, or of the full history on manual dispatch.
 
 ## Release Credentials