Skip to content

[CI] Workflow updates to use lychee link checker - #610

Merged
soumeh01 merged 2 commits into
mainfrom
workflow-updates
May 5, 2026
Merged

[CI] Workflow updates to use lychee link checker#610
soumeh01 merged 2 commits into
mainfrom
workflow-updates

Conversation

@soumeh01

@soumeh01 soumeh01 commented May 4, 2026

Copy link
Copy Markdown
Collaborator

Changes

  • Update to use the latest versionof common workflows

Checklist

  • 🤖 This change is covered by unit tests (if applicable).
  • 🤹 Manual testing has been performed (if necessary).
  • 🛡️ Security impacts have been considered (if relevant).
  • 📖 Documentation updates are complete (if required).
  • 🧠 Third-party dependencies and TPIP updated (if required).

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s CI-related metadata to align the markdown workflow with the newer shared workflow/link-checker setup and refreshes workflow permissions/badges around that change. It primarily affects GitHub Actions configuration and supporting link-check configuration files.

Changes:

  • Switched the markdown workflow from the old markdown link checker config to a new lychee-based config and updated the shared reusable workflow version.
  • Simplified the README status badges by replacing separate build/test badges with a single CI badge.
  • Tightened the dependency review workflow permission declarations.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
README.md Replaces separate build/test badges with a single CI badge.
.github/workflows/markdown.yml Updates the reusable markdown workflow version and points link checking at lychee.toml.
.github/workflows/dependency-review.yml Changes workflow/job permission declarations for dependency review.
.github/markdown-link-check.jsonc Removes the old markdown-link-check configuration file.
.github/lychee.toml Adds the new Lychee link checker configuration.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/dependency-review.yml
@soumeh01
soumeh01 force-pushed the workflow-updates branch from eaeba35 to 91e4fde Compare May 4, 2026 14:00
@soumeh01
soumeh01 marked this pull request as ready for review May 4, 2026 14:00
@github-actions

github-actions Bot commented May 4, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 11 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: The number of snapshots compared for the base SHA (0) and the head SHA (1) do not match. You may see unexpected additions in the diff.
Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

License Issues

.github/workflows/markdown.yml

PackageVersionLicenseIssue Type
Open-CMSIS-Pack/workflows-and-actions-collection/.github/workflows/markdown-lint.yml2.0.0NullUnknown License

go.mod

PackageVersionLicenseIssue Type
github.com/creack/ptyv1.1.21NullUnknown License
github.com/davecgh/go-spewv1.1.1NullUnknown License
github.com/hashicorp/go-versionv1.9.0NullUnknown License
github.com/otiai10/copyv1.14.1NullUnknown License
github.com/pmezard/go-difflibv1.0.0NullUnknown License
github.com/sirupsen/logrusv1.9.4NullUnknown License
github.com/spf13/cobrav1.10.2NullUnknown License
github.com/spf13/pflagv1.0.10NullUnknown License
github.com/stretchr/testifyv1.11.1NullUnknown License
gopkg.in/yaml.v3v3.0.1NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
actions/Open-CMSIS-Pack/workflows-and-actions-collection/.github/workflows/markdown-lint.yml 2.0.0 UnknownUnknown
gomod/github.com/aymanbagabas/go-pty v0.2.2 🟢 3.3
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/3 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 56 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy⚠️ 0security policy file not detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/creack/pty v1.1.21 UnknownUnknown
gomod/github.com/davecgh/go-spew v1.1.1 UnknownUnknown
gomod/github.com/hashicorp/go-version v1.9.0 UnknownUnknown
gomod/github.com/otiai10/copy v1.14.1 UnknownUnknown
gomod/github.com/pmezard/go-difflib v1.0.0 UnknownUnknown
gomod/github.com/sirupsen/logrus v1.9.4 UnknownUnknown
gomod/github.com/spf13/cobra v1.10.2 UnknownUnknown
gomod/github.com/spf13/pflag v1.0.10 UnknownUnknown
gomod/github.com/stretchr/testify v1.11.1 UnknownUnknown
gomod/github.com/u-root/u-root v0.11.0 🟢 7.4
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 4security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 2badge detected: InProgress
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 9binaries present in source code
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
gomod/golang.org/x/crypto v0.45.0 UnknownUnknown
gomod/golang.org/x/sync v0.8.0 UnknownUnknown
gomod/golang.org/x/sys v0.43.0 UnknownUnknown
gomod/golang.org/x/term v0.42.0 UnknownUnknown
gomod/gopkg.in/yaml.v3 v3.0.1 UnknownUnknown

Scanned Files

  • .github/workflows/markdown.yml
  • go.mod

@soumeh01
soumeh01 requested review from JonatanAntoni and brondani May 4, 2026 14:05
@soumeh01
soumeh01 merged commit 2ab5e5b into main May 5, 2026
4 checks passed
@soumeh01
soumeh01 deleted the workflow-updates branch May 5, 2026 07:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants