From 1c2c6ff02ebce040c5dfbab59ea6b94f45492abf Mon Sep 17 00:00:00 2001
From: rivassec <rivassec@rivassec.com>
Date: Fri, 11 Sep 2026 17:06:54 -0700
Subject: [PATCH] ci: consolidate lychee URL exclusions into .lycheeignore

One source of truth for both lychee layers (deploy's per-PR gate on
built HTML + the weekly link-rot scan of source markdown): lychee
reads .lycheeignore automatically, so deploy.yml's inline --exclude
URL flags move there. Path exclusions (--exclude-path) stay inline
since the ignore file holds URL patterns only.

Dress-rehearsed the full deploy sequence locally (build -> pagefind ->
lychee on output HTML): 5799 links, 0 errors, 26 excluded.
---
 .github/workflows/deploy.yml | 7 +++----
 .lycheeignore                | 9 ++++++++-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 38dfc419..56169b29 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -83,6 +83,9 @@ jobs:
           python3 scripts/csp_audit.py output
 
       - name: Check links in built site
+        # URL exclusions live in .lycheeignore (single source of truth, shared
+        # with the weekly link-rot workflow; lychee reads it automatically).
+        # Path exclusions stay inline: .lycheeignore holds URL patterns only.
         uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
         with:
           args: >-
@@ -93,10 +96,6 @@ jobs:
             --accept 200..=299,429
             --max-retries 5
             --retry-wait-time 2
-            --exclude "web\.archive\.org"
-            --exclude "linkedin\.com"
-            --exclude "hrw\.org"
-            --exclude "rivassec\.com/tools/iam-blast-radius"
             --exclude-path output/feeds
             --exclude-path output/tools
             './output/**/*.html'
diff --git a/.lycheeignore b/.lycheeignore
index 4aee3c2a..371a3530 100644
--- a/.lycheeignore
+++ b/.lycheeignore
@@ -7,7 +7,14 @@
 ^https?://host(:|$|/)
 ^https?://127\.0\.0\.1
 # Hosts that block automated checkers while working fine in browsers
-# (LinkedIn returns 999 to bots; X/Twitter gates aggressively).
+# (LinkedIn returns 999 to bots; X/Twitter gates aggressively; hrw.org and
+# web.archive.org rate-limit or gate scripted fetches).
 ^https?://(www\.)?linkedin\.com
 ^https?://(www\.)?x\.com
 ^https?://(www\.)?twitter\.com
+web\.archive\.org
+hrw\.org
+# The IAM Blast Radius tool page is a vendored SPA shipped as static files;
+# its internal anchors are not crawlable HTML (deploy also --exclude-path's
+# output/tools for the same reason).
+rivassec\.com/tools/iam-blast-radius