ci: add link check and changelog sync, harden Mintlify workflow

.github/workflows/linkcheck.yml

@@ -0,0 +1,79 @@
+name: Link check
+
+on:
+  pull_request:
+    paths:
+      - "**/*.mdx"
+      - "**/*.md"
+      - "docs.json"
+      - "package.json"
+      - "scripts/**"
+  push:
+    branches: [main]
+    paths:
+      - "**/*.mdx"
+      - "**/*.md"
+      - "docs.json"
+      - "package.json"
+      - "scripts/**"
+  schedule:
+    # Weekly, Monday 06:00 UTC — catches external-link rot between PRs.
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lychee:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Check navigation, internal links, anchors, assets and frontmatter
+        run: npm run check
+
+      - name: Restore lychee cache
+        uses: actions/cache@v4
+        with:
+          path: .lycheecache
+          key: cache-lychee-${{ github.sha }}
+          restore-keys: cache-lychee-
+
+      # External links only (--scheme): internal links, anchors and nav are already
+      # covered by `npm run check` above, and Mintlify-style extensionless paths like
+      # /updating are not resolvable as files. --root-dir keeps lychee from erroring
+      # while resolving root-relative links before the scheme filter excludes them.
+      # Do not pass `--base .`: current lychee releases reject it
+      # (base must be a URL or absolute path).
+      - name: Check external links
+        uses: lycheeverse/lychee-action@v2
+        with:
+          args: >-
+            --cache
+            --max-cache-age 1d
+            --no-progress
+            --scheme https
+            --scheme http
+            --root-dir ${{ github.workspace }}
+            --exclude-path images
+            --exclude-path .github
+            --accept 200,206,429
+            './**/*.mdx'
+            './**/*.md'
+          fail: true
+          jobSummary: true
+
+      - name: Open an issue when the scheduled run finds breakage
+        if: failure() && github.event_name == 'schedule'
+        uses: peter-evans/create-issue-from-file@v5
+        with:
+          title: Broken links found by scheduled link check
+          content-filepath: ./lychee/out.md
+          labels: docs, broken-links

.github/workflows/mintlify.yml

@@ -6,12 +6,22 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@v4

.github/workflows/sync-changelog.yml

@@ -0,0 +1,52 @@
+name: Sync changelog
+
+on:
+  schedule:
+    # Daily at 12:00 UTC.
+    - cron: "0 12 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Baseline check
+        run: npm run check
+
+      - name: Regenerate changelog.mdx from GitHub Releases
+        run: npm run sync-changelog
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Re-check after regeneration
+        run: npm run check
+
+      - name: Open a PR if the changelog moved
+        uses: peter-evans/create-pull-request@v6
+        with:
+          branch: chore/sync-changelog
+          delete-branch: true
+          title: "docs: sync changelog from GitHub Releases"
+          labels: docs, automation
+          commit-message: "docs: sync changelog from GitHub Releases"
+          body: |
+            Regenerated `changelog.mdx` from the product repo's GitHub Releases.
+
+            Reviewer checklist:
+
+            - [ ] Every new entry's summary reads as user-facing prose, not a commit subject.
+            - [ ] Component labels are right — `cli-v*` tags render as CLI, plain `v*` tags as Server.
+            - [ ] Each "Full release notes" link resolves to the right GitHub release.

changelog.mdx

@@ -0,0 +1,61 @@
+---
+title: Changelog
+description: "Published Mantis releases — CLI and server — what changed and where the full notes live."
+---
+
+{/* GENERATED FILE — do not edit by hand. */}
+{/* Regenerate with `npm run sync-changelog`; the source is GitHub Releases on privacykey/mantis. */}
+
+<Note>
+  This page mirrors [GitHub Releases](https://github.com/privacykey/mantis/releases) — `cli-v*` tags publish CLI
+  binaries, plain `v*` tags publish server releases. After updating, run `mantis doctor`
+  to confirm CLI/server compatibility, and see [Updating](/updating) for the per-component
+  update commands.
+</Note>
+## CLI v0.1.6
+
+14 May 2026
+
+Standalone CLI binaries for macOS and Linux on arm64 / x86_64. Each binary is built on its own native runner so the bundled native modules (`@napi-rs/keyring`) match the target.
+
+[Full release notes →](https://github.com/privacykey/mantis/releases/tag/cli-v0.1.6)
+
+## CLI v0.1.5
+
+14 May 2026
+
+Standalone CLI binaries for macOS and Linux on arm64 / x86_64. Each binary is built on its own native runner so the bundled native modules (`@napi-rs/keyring`) match the target.
+
+[Full release notes →](https://github.com/privacykey/mantis/releases/tag/cli-v0.1.5)
+
+## CLI v0.1.4
+
+14 May 2026
+
+Standalone CLI binaries for macOS and Linux on arm64 / x86_64. Each binary is built on its own native runner so the bundled native modules (`@napi-rs/keyring`) match the target.
+
+[Full release notes →](https://github.com/privacykey/mantis/releases/tag/cli-v0.1.4)
+
+## CLI v0.1.3
+
+13 May 2026
+
+Standalone CLI binaries for macOS and Linux on arm64 / x86_64. Each binary is built on its own native runner so the bundled native modules (`@napi-rs/keyring`) match the target.
+
+[Full release notes →](https://github.com/privacykey/mantis/releases/tag/cli-v0.1.3)
+
+## CLI v0.1.2
+
+13 May 2026
+
+Standalone CLI binaries for macOS and Linux on arm64 / x86_64. Each binary is built on its own native runner so the bundled native modules (`@napi-rs/keyring`) match the target.
+
+[Full release notes →](https://github.com/privacykey/mantis/releases/tag/cli-v0.1.2)
+
+## CLI v0.1.0
+
+13 May 2026
+
+Cross-compiled standalone CLI binaries for macOS and Linux on arm64 / x86_64.
+
+[Full release notes →](https://github.com/privacykey/mantis/releases/tag/cli-v0.1.0)

docs.json

@@ -54,7 +54,8 @@
           "configuration",
           "cli",
           "cli-backup",
-          "updating"
+          "updating",
+          "changelog"
         ]
       },
       {

package.json

@@ -4,6 +4,8 @@
   "scripts": {
     "dev": "npx --yes mint@latest dev",
     "validate": "npx --yes mint@latest validate",
-    "check-links": "npx --yes mint@latest broken-links"
+    "check-links": "npx --yes mint@latest broken-links",
+    "check": "node scripts/check-docs.mjs",
+    "sync-changelog": "node scripts/sync-changelog.mjs"
   }
 }