Add lychee link checker config and CI workflow

Adds a lychee configuration and a Links GitHub Actions workflow so that
stale or redirecting links are caught automatically going forward. The
checker runs on push, pull request, and weekly to catch external link
rot. max_redirects is 0 so links that have moved are surfaced and can be
updated to their canonical destination.

Part of STF-557.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: oschwald

.github/workflows/links.yml

@@ -0,0 +1,35 @@
+name: Links
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: "0 13 * * 1" # weekly, to catch external link rot without a commit
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  linkChecker:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write # required for peter-evans/create-issue-from-file
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Link Checker
+        id: lychee
+        uses: lycheeverse/lychee-action@885c65f3dc543b57c898c8099f4e08c8afd178a2 # v2.7.0
+        with:
+          fail: true
+          args: "'./**/*.md' './src/**/*.java' './pom.xml'"
+
+      - name: Create Issue From File
+        if: github.event_name == 'schedule' && steps.lychee.outputs.exit_code != 0
+        uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0
+        with:
+          title: Link Checker Report
+          content-filepath: ./lychee/out.md
+          labels: report, automated issue

.gitignore

@@ -20,3 +20,4 @@ pom.xml.versionsBackup
 target
 reports
 Test.java
+.lycheecache

lychee.toml

@@ -0,0 +1,64 @@
+# Lychee link checker configuration
+# https://lychee.cli.rs/#/usage/config
+#
+# Run locally with:
+#   lychee './**/*.md' './src/**/*.java' './pom.xml'
+
+# Include URL fragments in checks
+include_fragments = true
+
+# Don't allow any redirects, so links that have moved are surfaced and updated
+# to their canonical destination.
+max_redirects = 0
+
+# Accept these HTTP status codes
+# 100-103: Informational responses
+# 200-299: Success responses
+# 403: Forbidden (some sites use this for rate limiting)
+# 429: Too Many Requests
+# 500-599: Server errors (temporary issues shouldn't fail CI)
+# 999: LinkedIn's custom status code
+accept = ["100..=103", "200..=299", "403", "429", "500..=599", "999"]
+
+# Exclude URL patterns from checking (treated as regular expressions)
+exclude = [
+    '^file://',
+    # Live / auth-gated endpoints that appear as string literals or require login
+    '^https://geoip\.maxmind\.com',
+    '^https://geolite\.info',
+    '^https://minfraud\.maxmind\.com',
+    '^https://sandbox\.maxmind\.com',
+    '^https://updates\.maxmind\.com',
+    '^https://www\.maxmind\.com/en/accounts/',
+    'https://www\.maxmind\.com/en/account/login',
+    # XML namespace identifiers in pom.xml (not real links)
+    '^http://www\.w3\.org/',
+    '^http://maven\.apache\.org/',
+    '^https://maven\.apache\.org/xsd/',
+    '^http://java\.sun\.com/',
+    '^http://schemas\.',
+    # Maven property placeholder in a build-time download URL (not a real link)
+    'japicmp\.baselineVersion',
+    # Placeholders / local
+    '^https?://example\.(com|org|net)',
+    '^http://localhost',
+    '127\.0\.0\.1',
+]
+
+# Exclude file paths from getting checked (treated as regular expressions)
+exclude_path = [
+    'node_modules',
+    'target',
+    '\.git',
+    # Test fixtures (MaxMind-DB submodule) contain example URLs, not ours
+    'src/test/resources',
+    # Changelog: historical entries are preserved as-is, not rewritten
+    'CHANGELOG\.md',
+]
+
+# Cache results for 1 day to speed up repeated checks
+cache = true
+max_cache_age = "1d"
+
+# Skip missing input files instead of erroring
+skip_missing = true