Skip to content

(experimental) broken link checker (lychee) #2792

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 6 commits into
base: main
Choose a base branch
from
Draft

(experimental) broken link checker (lychee) #2792

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
86e660f
basic link checker (no comment/pr/cron automation)
dev-dist Jul 2, 2025
432e3bc
fix
dev-dist Jul 2, 2025
69ac4a1
fix
dev-dist Jul 2, 2025
b784f9e
fix
dev-dist Jul 2, 2025
b72a823
updated exclusions
dev-dist Jul 2, 2025
1366e5c
continue on error
dev-dist Jul 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .github/workflows/link-checker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: "🔗 Broken Link Checker"

on:
pull_request:
branches: [ main ]

jobs:
check-links:
runs-on: ubuntu-latest
steps:
- name: "☁️ Checkout Repository"
# Pinned to a full commit SHA to satisfy security best practices
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4

- name: "🔎 Run Link Checker"
# Pinned to a full commit SHA to satisfy the sha-ref validation error
uses: lycheeverse/lychee-action@2b591b68953f656281b36952a78484920668b598 # v2
with:
# Points to your source files and uses your lycheerc config
args: "--config ./lycheerc ./src/content/**/*.md*"
# Ensures the step passes so the check doesn't show as "failed"
fail: false
env:
# Required to check GitHub links without being rate-limited
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI about 1 month ago

To fix the issue, we will add a permissions block at the root of the workflow file. Since the workflow only needs to read repository contents and use the GITHUB_TOKEN for checking links, we will set contents: read as the minimal required permission. This ensures the workflow adheres to the principle of least privilege.

Suggested changeset 1
.github/workflows/link-checker.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/link-checker.yml b/.github/workflows/link-checker.yml
--- a/.github/workflows/link-checker.yml
+++ b/.github/workflows/link-checker.yml
@@ -6,2 +6,5 @@
 
+permissions:
+  contents: read
+
 jobs:
EOF
@@ -6,2 +6,5 @@

permissions:
contents: read

jobs:
Copilot is powered by AI and may make mistakes. Always verify output.
66 changes: 66 additions & 0 deletions .lycheerc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
# This file is used by the Lychee link checker to validate links in the documentation.
# The GH action is configured to check documentation source files (./src/content/**/*.md*)
# The exclude section below contains patterns to ignore certain links that are known to be problematic/not relevant
# Most notably, blockchain explorers, API endpoints that require authentication, and other support services that block bots or require login

############################# Display #############################
# Show informational output during the run
verbose = "error"
no_progress = false

############################# Runtime #############################
# Temporarily accept 429 -- rate limiting by gnu.org is very aggressive!!
accept = '200, 202, 429'

# Disable caching for clean test runs.
cache = false

max_concurrency = 10
max_retries = 3
retry_wait_time = 5

############################# Requests ############################
base_url = "https://docs.chain.link/"
timeout = 20

############################# Exclusions ##########################

# Exclude private, local, and loopback
exclude_all_private = true

exclude = [
# Blockchain Explorers (which cause 403 Forbidden errors)
".*scan\\.com",
".*scan\\.dev",
".*scan\\.io",
".*scan\\.xyz",
"basescan\\.org",
"snowtrace\\.io",
"celoscan\\.io",
"explorer\\.celo\\.org",
"explorer\\.metis\\.io",
"docs\\.polygon\\.technology",

# Other Services That Block Bots or Require Login
"infura\\.io",
"stackoverflow\\.com",
"ethereum\\.stackexchange\\.com",
"support\\.metamask\\.io",
"support\\.chainstack\\.com",
"faucet\\.polygon\\.technology",
"www\\.forex\\.com",
"debridges\\.com",
"help\\.phantom\\.app",
"app\\.roninchain\\.com",
"www\\.tronlink\\.org",

# API endpoints that require authentication
"api\\.dataengine\\.chain\\.link",
"api\\.testnet-dataengine\\.chain\\.link",
"app\\.dev3\\.sh", # Requires payment

# Common Local & Invalid Patterns
"^http://(localhost|127\\.0\\.0\\.1)(:\\d+)?",
"mailto:",
]

Loading