feat(ci): add CI quality gates - CODEOWNERS, markdownlint, link checking

.github/CODEOWNERS

@@ -0,0 +1,17 @@
+# CODEOWNERS — automatic reviewer assignment
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default: all PRs require review from maintainer
+* @Mossaka
+
+# Container definitions (security-sensitive)
+/containers/ @Mossaka
+
+# CI/CD workflows
+/.github/workflows/ @Mossaka
+
+# Documentation site
+/docs-site/ @Mossaka
+
+# Core source code
+/src/ @Mossaka

.github/aw/github-agentic-workflows.md

@@ -1404,7 +1404,7 @@ Analyze the issue and provide feedback.
 Add a comment to the issue with your analysis.
 ```
 
-## Permission Patterns
+## Common Permission Patterns
 
 ### Read-Only Pattern
 ```yaml

.github/lychee.toml

@@ -0,0 +1,43 @@
+# Lychee link checker configuration
+# See: https://lychee.cli.rs/usage/config/
+
+# Exclude localhost, example, and known-broken/template URLs
+exclude = [
+  "^https?://localhost",
+  "^https?://127\\.0\\.0\\.1",
+  "^https?://172\\.",
+  "^https?://example\\.com",
+  "^https?://your-",
+  "^https?://grafana\\.internal",
+  # Template variables in workflow .md files and release templates
+  "%7B",
+  "\\{\\{",
+  "\\{run_url\\}",
+  # External URLs that are flaky or return non-200 for automated checks
+  "^https?://contributor-covenant\\.org",
+  "^https://mcp\\.tavily\\.com",
+  "^https://docs\\.sigstore\\.dev/cosign/installation",
+  "^https://docs\\.github\\.com/en/github/site-policy/github-bug-bounty",
+  # LOGGING.md is referenced but doesn't exist yet (planned doc)
+  "LOGGING\\.md",
+]
+
+# Exclude files that don't exist but are referenced as future/planned docs
+exclude_path = [
+  "LOGGING.md",
+]
+
+# Accept 429 (rate limit) responses
+accept = [200, 429]
+
+# Timeout per request (seconds)
+timeout = 30
+
+# Max retries
+max_retries = 3
+
+# Max concurrent requests
+max_concurrency = 10
+
+# Don't check mail addresses
+exclude_mail = true

.github/workflows/link-check.yml

@@ -0,0 +1,34 @@
+name: Link Check
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - '**/*.md'
+      - '.github/lychee.toml'
+  schedule:
+    # Run weekly on Wednesdays at 06:00 UTC
+    - cron: '0 6 * * 3'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  link-check:
+    name: Check Documentation Links
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+
+      - name: Check links
+        uses: lycheeverse/lychee-action@f81112d0d2814ded911bd23e3beaa9dda9093915 # v2.3.0
+        with:
+          args: >-
+            --config .github/lychee.toml
+            --no-progress
+            '**/*.md'
+          fail: true

.github/workflows/lint.yml

@@ -6,7 +6,6 @@ on:
   pull_request:
     branches: [main]
     paths-ignore:
-      - '**/*.md'
       - '.github/workflows/release.yml'
 
 permissions:
@@ -33,3 +32,24 @@ jobs:
 
       - name: Run ESLint
         run: npm run lint
+
+  markdownlint:
+    name: Markdown Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run markdownlint
+        run: npm run lint:md

.markdownlint.json

@@ -0,0 +1,26 @@
+{
+  "default": true,
+  "MD007": false,
+  "MD009": false,
+  "MD012": false,
+  "MD013": false,
+  "MD022": false,
+  "MD024": {
+    "siblings_only": true
+  },
+  "MD025": false,
+  "MD026": false,
+  "MD028": false,
+  "MD029": false,
+  "MD031": false,
+  "MD032": false,
+  "MD033": false,
+  "MD034": false,
+  "MD036": false,
+  "MD038": false,
+  "MD040": false,
+  "MD041": false,
+  "MD047": false,
+  "MD056": false,
+  "MD058": false
+}