Merge pull request #642 from maxmind/greg/stf-557

Validate and update links (STF-557)

Author: horgh

.github/workflows/links.yml

@@ -0,0 +1,32 @@
+name: Links
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: "0 13 * * 1" # weekly, to catch external link rot without a commit
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  linkChecker:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup mise
+        uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
+        with:
+          install: false
+
+      # Install only lychee (not the repo's full toolchain) and run the check.
+      - name: Check links
+        env:
+          MISE_AUTO_INSTALL: "false"
+        run: |
+          mise install lychee
+          mise run check-links

.gitignore

@@ -9,6 +9,7 @@
 .claude
 .gh-pages
 .idea
+.lycheecache
 docs/.hugo_build.lock
 docs/public/
 .pmd

README.dev.md

@@ -19,9 +19,9 @@
 
 To get this access, first create a Central Portal account. You will then need
 access to our namespace, but we have not added anyone since switching to
-Central Portal. Previously you would need to make an account on the [Sonatype
-JIRA issue tracker](https://issues.sonatype.org/) and make an issue asking for
-access [like so](https://issues.sonatype.org/browse/OSSRH-34414).
+Central Portal. Previously you would need to make an account on the Sonatype
+JIRA issue tracker and make an issue asking for access. That tracker has since
+been [retired](https://central.sonatype.org/faq/what-happened-to-issues-sonatype-org/).
 
 Ensure you inform MaxMind operations about your new access.
 
@@ -52,7 +52,7 @@ and enter `trust` and choose ultimate.
 Make sure the key shows up in `gpg --list-secret-keys`.
 
 Make sure you publish it to a keyserver. See
-[here](http://central.sonatype.org/pages/working-with-pgp-signatures.html)
+[here](https://central.sonatype.org/publish/requirements/gpg/)
 for more info about that and the process in general.
 
 ### gpg "inappropriate ioctl" errors

README.md

@@ -327,7 +327,7 @@ Please report all issues with this code using the
 
 If you are having an issue with the minFraud service that is not specific
 to the client API, please see
-[our support page](https://www.maxmind.com/en/support).
+[our support page](https://support.maxmind.com/knowledge-base).
 
 ## Requirements ##
 

lychee.toml

@@ -0,0 +1,67 @@
+# Lychee link checker configuration
+# https://lychee.cli.rs/#/usage/config
+#
+# Run locally with:
+#   lychee './**/*.md' './src/**/*.java' './pom.xml'
+
+# Include URL fragments in checks
+include_fragments = true
+
+# Don't allow any redirects, so links that have moved are surfaced and updated
+# to their canonical destination.
+max_redirects = 0
+
+# Accept these HTTP status codes
+# 100-103: Informational responses
+# 200-299: Success responses
+# 403: Forbidden (some sites use this for rate limiting)
+# 429: Too Many Requests
+# 500-599: Server errors (temporary issues shouldn't fail CI)
+# 999: LinkedIn's custom status code
+accept = ["100..=103", "200..=299", "403", "429", "500..=599", "999"]
+
+# Exclude URL patterns from checking (treated as regular expressions)
+exclude = [
+    '^file://',
+    # Live / auth-gated endpoints that appear as string literals or require login
+    '^https://geoip\.maxmind\.com',
+    '^https://geolite\.info',
+    '^https://minfraud\.maxmind\.com',
+    '^https://sandbox\.maxmind\.com',
+    '^https://updates\.maxmind\.com',
+    '^https://www\.maxmind\.com/en/accounts/',
+    'https://www\.maxmind\.com/en/account/login',
+    # XML namespace identifiers in pom.xml (not real links)
+    '^http://www\.w3\.org/',
+    '^http://maven\.apache\.org/',
+    '^https://maven\.apache\.org/xsd/',
+    '^http://java\.sun\.com/',
+    '^http://schemas\.',
+    # Maven property placeholder in a build-time download URL (not a real link)
+    'japicmp\.baselineVersion',
+    # dev.maxmind.com docs render anchors client-side, so lychee cannot verify
+    # the #schema-... fragment even though the page (a clean 200) contains it.
+    '^https://dev\.maxmind\.com/minfraud/api-documentation/responses/#',
+    # Placeholders / local
+    '^https?://example\.(com|org|net)',
+    '^http://localhost',
+    '127\.0\.0\.1',
+]
+
+# Exclude file paths from getting checked (treated as regular expressions)
+exclude_path = [
+    '(^|/)node_modules/',
+    '(^|/)target/',
+    '(^|/)\.git/',
+    # Test code and fixtures contain example URLs (e.g. www.example.com), not ours
+    '(^|/)src/test/',
+    # Changelog: historical entries are preserved as-is, not rewritten
+    '(^|/)CHANGELOG\.md$',
+]
+
+# Cache results for 1 day to speed up repeated checks
+cache = true
+max_cache_age = "1d"
+
+# Skip missing input files instead of erroring
+skip_missing = true

mise.lock

@@ -9,6 +9,7 @@ disable_backends = [
 [tools]
 hugo = "latest"
 java = "latest"
+lychee = "latest"
 maven = "latest"
 
 [tasks.build-docs]
@@ -19,6 +20,10 @@ run = "hugo --source docs --minify"
 description = "Serve the docs site locally with Hugo dev server"
 run = "hugo server --source docs"
 
+[tasks.check-links]
+description = "Check links with lychee"
+run = "lychee --no-progress './**/*.md' './src/**/*.java' './pom.xml'"
+
 [hooks]
 enter = "mise install --quiet --locked"
 

mise.toml

@@ -7,17 +7,17 @@
     <version>4.3.0</version>
     <name>MaxMind minFraud API</name>
     <description>MaxMind minFraud Score, Insights, Factors and Report Transaction API</description>
-    <url>http://dev.maxmind.com/minfraud</url>
+    <url>https://dev.maxmind.com/minfraud/</url>
     <licenses>
         <license>
             <name>Apache License, Version 2.0</name>
-            <url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
+            <url>https://www.apache.org/licenses/LICENSE-2.0.html</url>
             <distribution>repo</distribution>
         </license>
     </licenses>
     <organization>
         <name>MaxMind, Inc.</name>
-        <url>http://www.maxmind.com/</url>
+        <url>https://www.maxmind.com/en/home</url>
     </organization>
     <scm>
         <url>https://github.com/maxmind/minfraud-api-java</url>

pom.xml

@@ -8,7 +8,8 @@
 
 /**
  * Custom inputs to be used in
- * <a href="https://www.maxmind.com/en/minfraud-interactive/#/custom-rules">Custom Rules</a>.
+ * <a href="https://www.maxmind.com/en/accounts/current/minfraud-interactive/custom-rules">Custom
+ * Rules</a>.
  * In order to use custom inputs, you must set them up from your account portal.
  */
 public final class CustomInputs extends AbstractModel {

src/main/java/com/maxmind/minfraud/request/CustomInputs.java

@@ -21,7 +21,7 @@
  *                   date-time.
  * @param localTime  The date and time of the transaction at the UTC offset associated with the
  *                   device. This is an RFC 3339 date-time.
- * @see <a href="https://dev.maxmind.com/minfraud/track-devices?lang=en">Device Tracking Add-on</a>
+ * @see <a href="https://dev.maxmind.com/minfraud/track-devices/?lang=en">Device Tracking Add-on</a>
  */
 public record Device(
     @JsonProperty("confidence")