Validate and update links (STF-557)

[oschwald]

Adds a lychee link checker config and a CI workflow, and fixes stale/redirecting links across the repo.

Tooling

• lychee.toml — shared MaxMind config (max_redirects = 0, accepts 500..=599, excludes XML namespaces, live/auth-gated endpoints, target/, src/test/, and CHANGELOG.md).
• .github/workflows/links.yml — runs lychee via mise (install: false, MISE_AUTO_INSTALL: false) so only lychee is installed, not the full toolchain.
• mise.toml — pins lychee = "0.23.0" and adds the check-links task; mise.lock populated with all platform entries.
• .lycheecache added to .gitignore.

Link fixes (old -> new)

• README.dev.md: http://central.sonatype.org/pages/working-with-pgp-signatures.html -> https://central.sonatype.org/publish/requirements/gpg/
• README.dev.md: the two retired issues.sonatype.org JIRA links replaced with a reference to https://central.sonatype.org/faq/what-happened-to-issues-sonatype-org/
• README.md: https://www.maxmind.com/en/support -> https://support.maxmind.com/knowledge-base
• pom.xml: http://dev.maxmind.com/minfraud -> https://dev.maxmind.com/minfraud/
• pom.xml: http://www.apache.org/licenses/LICENSE-2.0.html -> https://www.apache.org/licenses/LICENSE-2.0.html
• pom.xml: http://www.maxmind.com/ -> https://www.maxmind.com/en/home
• CustomInputs.java: https://www.maxmind.com/en/minfraud-interactive/#/custom-rules (404) -> https://www.maxmind.com/en/accounts/current/minfraud-interactive/custom-rules
• Device.java: https://dev.maxmind.com/minfraud/track-devices?lang=en -> https://dev.maxmind.com/minfraud/track-devices/?lang=en
• Warning.java: https://tools.ietf.org/html/rfc6901 -> https://datatracker.ietf.org/doc/html/rfc6901

Notes

• The dev.maxmind.com/minfraud/api-documentation/responses/#schema--... link in Reason.java is excluded from fragment checking: the page is a clean 200 but its anchors are rendered client-side, so lychee cannot verify the fragment.

Final lychee run: 22 OK, 0 Errors, 9 Excluded. mvn checkstyle:check passes.

Part of STF-557.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request integrates the Lychee link checker tool into the project, adding configuration files (lychee.toml), updating tool definitions in mise.toml and mise.lock, and correcting several outdated or broken URLs across documentation, POM, and Java source files. Feedback on the changes suggests refining the Lychee configuration by removing 5xx status codes from the accepted list to catch persistent server errors, updating the localhost exclusion pattern to support HTTPS, and using escaped double quotes in the mise.toml task command to ensure cross-platform compatibility on Windows.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Accepting all 5xx status codes (500..=599) globally will prevent the link checker from detecting genuinely broken links when a server is permanently down or misconfigured. Since lychee has built-in retry logic for transient errors, it is safer to remove 500..=599 from the accept list so that persistent server errors are correctly flagged.

Suggested change

	accept = ["100..=103", "200..=299", "403", "429", "500..=599", "999"]
	accept = ["100..=103", "200..=299", "403", "429", "999"]

[oschwald]

Keeping 500..=599 in accept, matching the dev-site and blog-site configs — transient upstream 5xx shouldn't fail link-checking CI.

— Claude (posted on Greg's behalf)

[gemini-code-assist]

The pattern ^http://localhost only matches HTTP local links. It is safer to use ^https?://localhost to also cover any local HTTPS endpoints if they are ever used.

Suggested change

	'^http://localhost',
	'^https?://localhost',

[oschwald]

localhost only appears as an http:// placeholder in this repo, so this is a no-op today; kept to match the shared template. Happy to broaden to https? if desired.

— Claude (posted on Greg's behalf)

[gemini-code-assist]

Using single quotes for arguments in the run command can cause issues on Windows environments (e.g., when run via cmd.exe), as single quotes are not stripped and are passed literally to the executable. Using escaped double quotes is more portable and cross-platform.

Suggested change

	run = "lychee --no-progress './**/*.md' './src/**/*.java' './pom.xml'"
	run = "lychee --no-progress \"./**/*.md\" \"./src/**/*.java\" \"./pom.xml\""

[oschwald]

The check-links task runs on ubuntu-latest (bash) in CI, where the single quotes are correct — they stop the shell from expanding the globs so lychee globs them itself. It isn't run on Windows.

— Claude (posted on Greg's behalf)