ci(link-check): fix the scheduled online link-check lane

[kyle-sexton]

Problem

Both scheduled online link-check runs behind the rolling tracking issues did not fail on dead links — every one of this repo's 173 external links resolves (verified with a full-repo online lychee 0.24.2 run against modules/lychee/lychee.toml). The runs died before checking anything: error: unexpected argument '--accept-timeouts' found. The reusable ci-workflows link-check.yml passes default args that rely on --accept-timeouts (lychee ≥ 0.24) while leaving lychee-action at its default lychee v0.23.0, which also predates the include_fragments = "full" config form this repo's ruleset requires (module engine floor 0.24.2+).

Change

1. Fixture exclusion (this branch, ready): the online lane also verifies local file links, so once the version is fixed it would flag fixtures/lychee/bad/ on every scheduled run and re-open the tracking issue forever. The caller now overrides the called workflow's args to add --exclude-path 'fixtures/[^/]+/bad', mirroring the offline lane's exclusion in ci.yml (args is a single input, so the defaults are restated). Verified locally: with the exclusion, a full online run reports 0 errors.
2. Pin bump (pending, this PR stays draft until then): the version fix itself lives in the reusable workflow — fix(link-check): pin lychee v0.24.2 so --accept-timeouts is recognized ci-workflows#52 (pins lycheeVersion: v0.24.2 and moves lychee-action past v2.8.0 for the 0.24.x archive layout). That PR is green/CLEAN but not yet merged. Once it lands, this branch gets the repo-wide ci-workflows pin bump to the new SHA (per the convention from build(deps): bump ci-workflows pin to b6431a1 (PSSA RULE_ERROR retry fix) #44, which also refreshes the stale # b6431a1 pin comments left by the Dependabot SHA-only bump) and the PR will be marked ready.

Verification plan

After merge: workflow_dispatch the link-check workflow and confirm a green end-to-end run.

Closes #13
Closes #54

🤖 Generated with Claude Code

https://claude.ai/code/session_017K9RRMdUKD7HLExmHwMXAe

---

Note

Low Risk
CI-only workflow input change; no application runtime or security-sensitive code paths.

Overview
The scheduled online link-check job now passes an explicit with.args to the reusable link-check workflow instead of relying solely on its defaults.

Because args is one input, the override restates the called workflow’s lychee flags (--cache, --max-cache-age 7d, --no-progress, --accept-timeouts, config path, and '.**/*.md') and adds --exclude-path 'fixtures/[^/]+/bad' so intentionally broken lychee fixtures are skipped—matching the offline lychee lane in ci.yml. That prevents the online lane (which also checks local file links) from failing every run and reopening the rolling tracking issue once lychee is on a version that supports those args.

^{Reviewed by Cursor Bugbot for commit 0295733. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude finished @kyle-sexton's task in 1m 58s —— View job

---

PR Review

• Gather context
• Read CLAUDE.md guidelines (no CLAUDE.md present in this repo)
• Review changed files
• Post review findings

---

Summary

The change is small, correct, and well-reasoned. The fixture exclusion closes a real gap: fixtures/lychee/bad/Violations.md contains intentionally broken local file references that the online lane would flag on every scheduled run (since lychee checks local links even in online mode). The exclusion pattern mirrors the offline lane in ci.yml exactly.

No bugs, no security issues. A few observations below.

---

Findings

[Intentional] Incomplete fix with current SHA — link-check.yml L21

The SHA 0c5a0654... still pins ci-workflows to the version that ships lychee v0.23.0. With that version, --accept-timeouts (now restated in the overridden args) will still cause the same crash the PR is trying to fix. The PR body correctly flags this as a two-step process — the fixture exclusion lands here and the version bump follows once upstream ci-workflows#52 merges. The draft marking and the PR description are transparent about this, so no action needed; just confirming the analysis is correct.

[Observation] args restatement is the right call — link-check.yml L28–35

Because args is a single string input, there's no way to append without restating defaults — the comment in the file explains this. One risk: if ci-workflows ever changes its default args, this override would silently drift. That's already a known cost of the single-input design; the comment makes the intent clear enough for future maintainers.

[Observation] Exclusion pattern scope is appropriately broad

fixtures/[^/]+/bad will match any fixtures/*/bad directory added in the future (not just fixtures/lychee/bad). This mirrors what ci.yml line 71 does for the offline lane. Consistent and future-proof.

[Observation] Single-quoted glob in YAML block scalar — link-check.yml L35

'./**/*.md' uses shell single-quotes to prevent glob expansion before lychee processes the pattern. This is correct for how lychee-action interpolates args into the shell command. No change needed.

---

Verdict

The fixture exclusion is correct and the comment explaining the args-restatement tradeoff is appropriate. Merge sequencing (waiting for ci-workflows#52) is the right call — the fix would regress without the upstream lychee version bump. LGTM once the upstream merges and the SHA is bumped.

[claude]

Claude finished @kyle-sexton's task in 0s —— View job

---

I'll analyze this and get back to you.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0295733944

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin a lychee version before passing this flag

For scheduled or manual runs while this workflow still calls ci-workflows at 0c5a0654..., the reusable workflow invokes lycheeverse/lychee-action@8646ba.../v2.8.0, whose action.yml defaults lycheeVersion to v0.23.0; that version rejects --accept-timeouts as an unexpected argument, so the job still exits before checking any links or applying the new fixture exclusion. Either bump the reusable workflow SHA to one that sets lychee >=0.24 or avoid restating this flag here until that pin changes.

Useful? React with 👍 / 👎.

[cursor]

Risk: low. Cursor Bugbot completed successfully with no findings requiring human review. Approved; no reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}