fix(link-check): pin lychee v0.24.2 so --accept-timeouts is recognized by kyle-sexton · Pull Request #52 · melodic-software/ci-workflows

kyle-sexton · 2026-07-04T10:39:45Z

Problem

Every run of the reusable online link-check workflow has been failing before checking a single link:

error: unexpected argument '--accept-timeouts' found

lychee-action v2.8.0 installs lychee v0.23.0 by default, but --accept-timeouts was only added in lychee 0.24.0 (lycheeverse/lychee#2063). Since the workflow's default args pass that flag, lychee exits with a CLI usage error, the action reports a non-zero exit code, and consumers file/refresh their "Link checker report" tracking issue on every scheduled run (e.g. melodic-software/.github#6) without any links actually being checked.

Fix

Pin lycheeVersion: v0.24.2 on the lychee-action step — the same lychee version the lychee-offline lane installs. A comment at the pin records that this site sits inside a workflow, so tool-version-drift-check (which reads action-input defaults) does not watch it; bump it together with lychee-offline's version default.

Verification

Reproduced locally with lychee 0.24.2: --accept-timeouts is accepted and the check runs end to end (0.23.0 rejects it; 0.24.0 release notes confirm the flag's introduction).
lychee-action's installer maps lycheeVersion: v0.24.2 to the lychee-v0.24.2 release tag for modern versions, so the pinned value downloads correctly.
actionlint and typos clean on the changed file.

Consumers pinned to an older SHA still carry the broken default and need a pin bump (melodic-software/.github follows in a separate PR closing its tracking issue).

🤖 Generated with Claude Code

https://claude.ai/code/session_017K9RRMdUKD7HLExmHwMXAe

Note

Low Risk
CI-only advisory link-check workflow; no application runtime, auth, or data-path changes.

Overview
Fixes the reusable link-check workflow so it can run at all instead of dying on a CLI error before checking links.

The lychee-action step moves from v2.8.0 to a master SHA (post-v2.8.0) so the installer works with lychee ≥ 0.24 tarballs and can install a binary that understands --accept-timeouts, which the workflow’s default args already pass. lycheeVersion: v0.24.2 is set explicitly to match the lychee-offline lane and keep runs deterministic; comments note bumping both together and that drift checks only watch the offline action default.

^{Reviewed by Cursor Bugbot for commit 628a6b7. Bugbot is set up for automated code reviews on this repo. Configure here.}

lychee-action v2.8.0 installs lychee v0.23.0 by default, which predates --accept-timeouts (added in lychee 0.24.0). The default args pass that flag, so every online link-check run died on a CLI usage error before checking a single link and filed the tracking issue. Pin lycheeVersion to v0.24.2, matching the lychee-offline lane. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017K9RRMdUKD7HLExmHwMXAe

claude · 2026-07-04T10:39:59Z

Claude finished @kyle-sexton's task in 1m 24s —— View job

PR Review

Gather context and read changed files
Review diff for correctness, security, and CLAUDE.md alignment
Post findings

Verdict: LGTM. The fix is correct, well-scoped, and properly documented.

What changed

link-check.yml L61 adds lycheeVersion: v0.24.2 to the lychee-action step. That's the minimum necessary change to unblock every consumer stuck on the CLI usage error.

Correctness

Root cause is accurately diagnosed. --accept-timeouts was added in lychee 0.24.0; lychee-action v2.8.0 ships v0.23.0 by default. The PR pins past that boundary.
Version parity confirmed. lychee-offline/action.yml L19 pins version: 0.24.2. The v-prefix difference between the two lanes is expected — lychee-action maps v0.24.2 → lychee-v0.24.2 release tag; the offline lane constructs the URL as lychee-v${{ inputs.version }}. Both resolve to the same binary.
The drift-check claim in the comment is accurate. tool-version-drift-check.yml L64 reads yq ".inputs.\"version\".default" from lychee-offline/action.yml only — it has no visibility into lycheeVersion embedded in the reusable workflow.

CLAUDE.md compliance

SHA pin intact. lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 is unchanged; no new uses: references were added, so no additional pinning is required.
Comment explains the why. The added comment covers the version gap, the fix, and the manual-bump requirement — exactly what CLAUDE.md asks for when the "why" is non-obvious.

No concerns

No security, logic, or maintainability issues. The change is minimal and targeted.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 728d75e850

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Review caught that lychee-action v2.8.0's installer expects the lychee binary at the archive root, while lychee >= 0.24 tarballs nest it in a subdirectory — the v0.24.2 pin alone would have failed at install time. Master's installer auto-detects the nested binary, so pin the action to master HEAD until the fix ships in a release. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017K9RRMdUKD7HLExmHwMXAe

claude · 2026-07-04T10:49:31Z

Claude finished @kyle-sexton's task in 2m 27s —— View job

PR Review

Gather context and read changed files
Review diff for correctness, security, and CLAUDE.md alignment
Assess Codex archive-layout concern and second commit
Post findings

Verdict: Approve with one operational note. The second commit correctly addresses the Codex-raised archive layout concern. Both root causes are fixed; one risk is worth documenting before merge.

What changed across both commits

Commit	Change
`728d75e`	Added `lycheeVersion: v0.24.2` to fix `--accept-timeouts` unrecognized by lychee-action's default lychee v0.23.0
`164ed7f`	Changed action SHA from `v2.8.0` to a post-v2.8.0 master commit, fixing the archive layout incompatibility Codex flagged

The final state: link-check.yml L53–65

Correctness

Both problems are accurately diagnosed and fixed together:

Archive layout fix confirmed. lychee-offline/action.yml L35–36 shows ARCHIVE_MEMBER: lychee-x86_64-unknown-linux-gnu/lychee and STRIP_COMPONENTS: '1' — confirming that lychee 0.24.x tarballs do nest the binary in a subdirectory. lychee-action v2.8.0's bundled installer expects it at the archive root, so the Codex concern was valid and the second commit addresses it.
--accept-timeouts fix correct. lychee 0.24.0 is the version that introduced the flag; pinning lycheeVersion: v0.24.2 aligns with the offline lane's pin and resolves the immediate failure.
Prose comment is accurate. The comment above the step clearly explains both problems and the temporary nature of the master pin. The tool-version-drift-check.yml manifest reads only lychee-offline's version default (L64), so lycheeVersion inside the reusable workflow is indeed invisible to it — the comment is accurate.

Security / CLAUDE.md

The SHA itself is still pinned (content-addressed, immutable) — the security requirement is met. The deviation from the # vX.Y.Z comment convention is intentional and documented because no tagged release with both fixes exists yet.

Operational risk: Dependabot may roll this back to v2.8.0

.github/dependabot.yml runs weekly GitHub Actions updates with no ignore rules. When Dependabot encounters:

uses: lycheeverse/lychee-action@e7477775... # master (post-v2.8.0)

it cannot parse master (post-v2.8.0) as a semver and may fall back to comparing against the latest release (v2.8.0). The outcome is a Dependabot PR resetting the SHA to 8646ba30... with # v2.8.0 — reintroducing both the archive layout bug and the --accept-timeouts error. If that PR is merged under a grouped update without careful review, the fix regresses silently.

The comment says "drop back to a release tag once one ships," which is the right long-term intent. Until then, one of these mitigations is worth adding:

Option A — Add an explicit ignore to dependabot.yml to suppress rollback PRs until a patched release exists:

ignore:
  - dependency-name: lycheeverse/lychee-action
    update-types: ["version-update:semver-patch", "version-update:semver-minor", "version-update:semver-major"]

Option B — Add a comment in the grouped Dependabot PR review process noting that lychee-action bumps should be rejected until the comment reads # v2.9.x or higher. This is lower-overhead but relies on reviewer memory.

Either approach is acceptable; Option A makes the intent machine-readable and removes the review-time risk. Fix this →

No other correctness, security, or maintainability issues found.

claude · 2026-07-04T11:15:16Z

Claude finished @kyle-sexton's task in 2m 1s —— View job

PR Review

Gather context and read changed files
Review diff for correctness, security, and CLAUDE.md alignment
Assess Dependabot rollback risk and current state
Post findings

Verdict: LGTM. Both root causes are correctly fixed; the merge-from-main commit brings in no conflicts. One residual operational risk from the prior review remains open.

Changes reviewed (commits `728d75e` + `164ed7f`)

link-check.yml L51–65

- uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
+ # ...comment explaining both problems...
+ uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # master (post-v2.8.0)
  with:
    args: ${{ inputs.args }}
+   lycheeVersion: v0.24.2
    fail: false

Correctness

Both problems are accurately diagnosed and fixed:

--accept-timeouts flag — introduced in lychee 0.24.0; lychee-action v2.8.0 ships 0.23.0 by default. lycheeVersion: v0.24.2 resolves it and matches lychee-offline/action.yml L19 (version: 0.24.2 / v-prefix difference is expected and harmless).
Archive layout — lychee ≥ 0.24 tarballs nest the binary under lychee-x86_64-unknown-linux-gnu/; v2.8.0's installer expects it at the archive root. The master HEAD pin (e7477775) fixes this. The prose comment explaining both issues and the temporary nature of the master pin is accurate.
drift-check claim — tool-version-drift-check.yml L64 reads only lychee-offline's version default, so lycheeVersion embedded in the reusable workflow is genuinely invisible to it. The comment is accurate.

CLAUDE.md compliance

SHA is pinned (content-addressed, immutable); the deviation from a # vX.Y.Z comment is intentional and documented in the step comment. No new uses: references added without a SHA pin.

Residual risk: Dependabot may roll back to v2.8.0

.github/dependabot.yml has no ignore rule for lycheeverse/lychee-action. When Dependabot cannot resolve master (post-v2.8.0) as semver, it may offer a PR restoring 8646ba30... (# v2.8.0) — reintroducing both bugs silently if the grouped update is merged without careful review. This risk was flagged in the prior review and remains open.

To make the intent machine-readable, consider adding to dependabot.yml: Fix this →

# dependabot.yml (proposed addition)
ignore:
  - dependency-name: lycheeverse/lychee-action
    update-types:
      - version-update:semver-patch
      - version-update:semver-minor
      - version-update:semver-major
    # Remove when the master SHA is dropped for a release tag.

This is optional — if reviewers are confident in catching a Dependabot rollback during weekly review, it can be skipped.

No correctness, security, or maintainability issues found in the current diff.

kyle-sexton · 2026-07-04T11:25:43Z

Status: branch updated past #53, all checks green, Codex thread addressed (lychee-action master installer handles the 0.24.x nested-tarball layout) and resolved, Cursor re-approved — mergeable (CLEAN). Ready for squash-merge.

Downstream: kyle-sexton/dotfiles has a prepared caller-side PR (pin bump + private-repo lychee excludes, verified locally against lychee 0.24.2 with zero errors) waiting on this merge SHA to close kyle-sexton/dotfiles#92. Agent-side merge attempts here are permission-gated (no human approval on record), so this needs a human (or otherwise merge-authorized) actor.

claude · 2026-07-04T12:09:44Z

Claude finished @kyle-sexton's task in 1m 19s —— View job

PR Review

Gather context and read changed files
Review diff for correctness, security, and CLAUDE.md alignment
Assess Dependabot rollback risk mitigation status
Post findings

Verdict: LGTM. The sync commit brings no conflicts; the fix is correct and complete.

Scope

This sync (commit 9985d0c) merges main into the branch — picking up #53 (action-default bumps for editorconfig-checker, ruff, pyright) and #54 (NuGet OSV-Scanner coverage). Neither touches link-check.yml. The effective diff against origin/main is unchanged from the prior review.

Fix correctness

link-check.yml L53–65 — both root causes are addressed:

--accept-timeouts unrecognized — introduced in lychee 0.24.0; lychee-action v2.8.0 ships v0.23.0 by default. lycheeVersion: v0.24.2 resolves it and aligns with lychee-offline/action.yml L19 (version: 0.24.2; v-prefix difference is expected and harmless).
Archive layout mismatch — lychee ≥ 0.24 tarballs nest the binary under lychee-x86_64-unknown-linux-gnu/; v2.8.0's installer expects it at the root. The master-HEAD pin (e7477775) ships the updated installer that handles both layouts.

The inline comment is accurate: tool-version-drift-check.yml L64 reads only lychee-offline's version input default, so lycheeVersion embedded in this reusable workflow is invisible to it.

CLAUDE.md compliance

SHA pinned. e7477775783ea5526144ba13e8db5eec57747ce8 is a full 40-char SHA — the security requirement is met. The deviation from the # vX.Y.Z convention is intentional and documented (no clean release tag exists yet).
No new unpinned uses: references.

Residual risk: Dependabot rollback (still unmitigated)

.github/dependabot.yml has no ignore rule for lycheeverse/lychee-action. Dependabot cannot resolve master (post-v2.8.0) as semver and may offer a grouped-update PR that resets the SHA to 8646ba30... (# v2.8.0) — silently reintroducing both bugs if merged without careful review. This has been flagged in two prior reviews.

Since the step comment explicitly says "drop back to a release tag once one ships," this ignore entry is strictly temporary. If the reviewer cadence is reliable enough to catch a Dependabot rollback, Option B (vigilance at review time) is workable. If you'd prefer machine-readable protection until a tagged release lands, the addition is: Fix this →

# dependabot.yml — add under the github-actions update block
ignore:
  - dependency-name: lycheeverse/lychee-action
    update-types:
      - version-update:semver-patch
      - version-update:semver-minor
      - version-update:semver-major
    # Remove when the master SHA is replaced with a release tag.

This is optional, not a blocker. No correctness, security, or maintainability issues found in the current diff.

claude · 2026-07-07T03:40:54Z

Claude finished @kyle-sexton's task in 0s —— View job

I'll analyze this and get back to you.

cursor

Risk: low. Cursor Bugbot completed successfully with no findings requiring human review. Approved; no reviewers assigned.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

## Problem Both scheduled online link-check runs behind the rolling tracking issues did not fail on dead links — every one of this repo's 173 external links resolves (verified with a full-repo online lychee 0.24.2 run against `modules/lychee/lychee.toml`). The runs died before checking anything: `error: unexpected argument '--accept-timeouts' found`. The reusable ci-workflows `link-check.yml` passes default args that rely on `--accept-timeouts` (lychee ≥ 0.24) while leaving lychee-action at its default **lychee v0.23.0**, which also predates the `include_fragments = "full"` config form this repo's ruleset requires (module engine floor 0.24.2+). ## Change 1. **Fixture exclusion (this branch, ready):** the online lane also verifies local file links, so once the version is fixed it would flag `fixtures/lychee/bad/` on every scheduled run and re-open the tracking issue forever. The caller now overrides the called workflow's `args` to add `--exclude-path 'fixtures/[^/]+/bad'`, mirroring the offline lane's exclusion in `ci.yml` (`args` is a single input, so the defaults are restated). Verified locally: with the exclusion, a full online run reports 0 errors. 2. **Pin bump (pending, this PR stays draft until then):** the version fix itself lives in the reusable workflow — melodic-software/ci-workflows#52 (pins `lycheeVersion: v0.24.2` and moves lychee-action past v2.8.0 for the 0.24.x archive layout). That PR is green/CLEAN but not yet merged. Once it lands, this branch gets the repo-wide ci-workflows pin bump to the new SHA (per the convention from #44, which also refreshes the stale `# b6431a1` pin comments left by the Dependabot SHA-only bump) and the PR will be marked ready. ## Verification plan After merge: `workflow_dispatch` the link-check workflow and confirm a green end-to-end run. Closes #13 Closes #54 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017K9RRMdUKD7HLExmHwMXAe Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

cursor Bot approved these changes Jul 4, 2026 •

edited

Loading

View reviewed changes

chatgpt-codex-connector Bot reviewed Jul 4, 2026

View reviewed changes

Comment thread .github/workflows/link-check.yml

cursor Bot approved these changes Jul 4, 2026 •

edited

Loading

View reviewed changes

kyle-sexton mentioned this pull request Jul 4, 2026

Link checker report melodic-software/claude-code-plugins#18

Closed

Merge branch 'main' into fix/link-check-lychee-version

c6c193e

cursor Bot approved these changes Jul 4, 2026 •

edited

Loading

View reviewed changes

Merge branch 'main' into fix/link-check-lychee-version

9985d0c

cursor Bot approved these changes Jul 4, 2026 •

edited

Loading

View reviewed changes

kyle-sexton mentioned this pull request Jul 4, 2026

ci(link-check): fix the scheduled online link-check lane melodic-software/standards#61

Merged

Merge branch 'main' into fix/link-check-lychee-version

628a6b7

kyle-sexton enabled auto-merge (squash) July 7, 2026 03:40

kyle-sexton merged commit e2c2a6e into main Jul 7, 2026
32 checks passed

kyle-sexton deleted the fix/link-check-lychee-version branch July 7, 2026 03:41

cursor Bot approved these changes Jul 7, 2026

View reviewed changes

Navigation Menu

Uh oh!

fix(link-check): pin lychee v0.24.2 so --accept-timeouts is recognized - #52

fix(link-check): pin lychee v0.24.2 so --accept-timeouts is recognized#52
kyle-sexton merged 5 commits into
mainfrom
fix/link-check-lychee-version

kyle-sexton commented Jul 4, 2026 •

edited by cursor Bot

Loading

Uh oh!

claude Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

claude Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

kyle-sexton commented Jul 4, 2026

Uh oh!

claude Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

kyle-sexton commented Jul 4, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Verification

Uh oh!

claude Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

What changed

Correctness

CLAUDE.md compliance

No concerns

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

claude Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

What changed across both commits

Correctness

Security / CLAUDE.md

Operational risk: Dependabot may roll this back to v2.8.0

Uh oh!

Uh oh!

claude Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

Changes reviewed (commits 728d75e + 164ed7f)

Correctness

CLAUDE.md compliance

Residual risk: Dependabot may roll back to v2.8.0

Uh oh!

Uh oh!

kyle-sexton commented Jul 4, 2026

Uh oh!

claude Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

Scope

Fix correctness

CLAUDE.md compliance

Residual risk: Dependabot rollback (still unmitigated)

Uh oh!

Uh oh!

claude Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kyle-sexton commented Jul 4, 2026 •

edited by cursor Bot

Loading

claude Bot commented Jul 4, 2026 •

edited

Loading

claude Bot commented Jul 4, 2026 •

edited

Loading

claude Bot commented Jul 4, 2026 •

edited

Loading

Changes reviewed (commits `728d75e` + `164ed7f`)

claude Bot commented Jul 4, 2026 •

edited

Loading

claude Bot commented Jul 7, 2026 •

edited

Loading