Harden link checker workflow dependencies

[Celeste de Guzman (CelesteDG)]

Summary

• pin lycheeverse/lychee-action and peter-evans/create-issue-from-file to immutable release commit SHAs
• retain the existing immutable actions/checkout v3.7.0 pin and prevent it from persisting credentials
• reduce the workflow's contents permission from write to read
• remove the GitHub token from Lychee and pass it only to the issue-creation action

Security impact

The workflow previously executed two third-party actions from mutable branch references during scheduled, push, and dispatch runs with a write-scoped GITHUB_TOKEN. Compromise of either upstream branch could therefore execute untrusted code with repository permissions (CWE-829).

This change preserves the existing triggers, preprocessing, .lychee.toml configuration, failure behavior, and automated issue reporting while reducing token exposure.

Pinned releases

• actions/checkout v3.7.0 (existing pin)
• lycheeverse/lychee-action v2.9.0
• peter-evans/create-issue-from-file v6.0.0

Validation

• parsed the updated workflow as YAML
• verified each release tag resolves to the pinned full commit SHA
• confirmed no mutable action references remain in the workflow
• confirmed the diff contains only workflow hardening changes

[learn-build-service-prod]

Learn Build status updates of commit fa4ba60:

✅ Validation status: passed

File	Status	Preview URL	Details
.github/workflows/linkchecker.yml	✅Succeeded

For more details, please refer to the build report.

[learn-build-service-prod]

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

[Regan Downer (v-regandowner)]

Celeste de Guzman (@CelesteDG) - Do you want us to wait for Mark's approval or go ahead and merge?

#label:"aq-pr-triaged"
@MicrosoftDocs/public-repo-pr-review-team