[seantronsen]

Description

Adds lint-docs, a reusable dead-link check ported from OpenCHAMI/fabrica#48. It runs lychee via lycheeverse/lychee-action over every .md, .html, and .rst file, and reports broken links instead of failing:

• PRs that change docs: findings are uploaded to code scanning as SARIF, so they show up as github-advanced-security review comments with "Dismiss alert", like lint-ci's zizmor findings. They clear once a later commit fixes the link. Fork PRs only get the job summary.
• Default branch (push, schedule, dispatch): keeps one open "Docs link check found broken links" issue, created or updated each run and closed once the links are fixed. Timeouts alone don't open it.
• Configuration: callers configure lychee with their own lychee.toml and .lycheeignore. The only input is issue-title.
• Failure: the job fails only when lychee itself errors.
• Dogfooding: 0-local-ci runs it against this repo's docs.
• Docs: docs/workflows.md#lint-docs, plus the README index.

Stacked on #51. Closes #49.

Testbed: OpenCHAMI/github-actions-testbed#15.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[synackd]

This looks cool. Just one finding on concurrent jobs.

[synackd]

The concurrency group prevents two report-issue jobs from editing the issue at the same time, but it does not ensure they run in commit order. If an older default-branch link scan finishes after a newer one, it can overwrite or close the issue using stale findings.

Could the reporter check that GITHUB_SHA still matches the current default-branch HEAD before updating the issue? A stale run could then exit without changing the latest issue state.