.github/workflows/markdown-checks.yml (3)

3-7: Consider adding path filters for efficiency.

The workflow triggers on all pull requests and pushes to master, even when no markdown files are modified. Adding path filters would prevent unnecessary workflow runs.

⚡ Proposed optimization

 on:
   pull_request:
     branches: [master]
+    paths:
+      - '**.md'
+      - '.markdownlint.json'
+      - '.github/workflows/markdown-checks.yml'
   push:
     branches: [master]
+    paths:
+      - '**.md'
+      - '.markdownlint.json'
+      - '.github/workflows/markdown-checks.yml'

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/markdown-checks.yml around lines 3 - 7, The workflow
currently triggers for every pull_request and push to master; narrow triggers by
adding path filters under the existing on -> pull_request and on -> push keys
(use the YAML keys pull_request, push and add a paths list) to only run when
markdown files change (e.g., include patterns like '**/*.md' and
'.github/**/*.md'); update the .github/workflows/markdown-checks.yml to include
these paths entries for both pull_request and push to avoid unnecessary runs.

---

25-39: Consider SHA pinning for the lychee action.

The link-check configuration looks well-structured with appropriate timeout and retry settings. The --exclude "mailto:" is correct since mailto links aren't HTTP(S) endpoints.

For security, consider pinning to a specific commit SHA instead of the @v2 tag to prevent supply chain attacks from tag updates. For example: uses: lycheeverse/lychee-action@7da8ec1fc4e01b5a12062ac6c589c10a4ce70d67. You can use Dependabot to automate SHA updates.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/markdown-checks.yml around lines 25 - 39, Replace the
floating tag for the lychee action usage (currently referenced as
lycheeverse/lychee-action@v2) with a specific commit SHA to hard-pin the action;
update the GitHub Action step that uses lycheeverse/lychee-action@v2 to use a
concrete commit hash (e.g. the example 7da8ec1fc4e01b5a12062ac6c589c10a4ce70d67)
and consider adding Dependabot to keep that SHA updated automatically.

---

14-19: Consider pinning to commit SHAs and update markdownlint action to latest version.

The workflow uses mutable version tags (@v4, @v16) which can be updated by maintainers without notice. For improved security and reproducibility, pin to specific commit SHAs instead (e.g., actions/checkout@b4c9fea...).

Additionally, DavidAnson/markdownlint-cli2-action@v16 is outdated; the latest version is v23.0.0. Update to the current version for bug fixes and improvements.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/markdown-checks.yml around lines 14 - 19, Replace mutable
action tags with pinned commit SHAs: update the uses references for
actions/checkout and DavidAnson/markdownlint-cli2-action (the current uses
entries "actions/checkout@v4" and "DavidAnson/markdownlint-cli2-action@v16") to
their corresponding commit SHA pins, and bump the markdownlint action to the
latest release (v23.0.0) before pinning; keep the same inputs (e.g., the "globs"
input) unchanged while ensuring the new pinned SHAs match the chosen versions.