timothyswan/lychee repository overview

lychee⁠ is a fast, parallel link checker for Markdown, HTML, reStructuredText, plain text, and source code comments. It catches broken URLs in documentation before they ship — and is especially valuable in air-gapped deployments where many external links won't resolve from production at all.

This image builds lychee from upstream source on hi/rust and lands on hi/core-runtime (Red Hat Hardened, distroless glibc). The binary is cosign-signed with a CycloneDX SBOM and SLSA Level 3 provenance attestation attached.

⁠Usage

# Check all Markdown + HTML in a repo (default lychee behaviour)
podman run --rm -v "$(pwd):/repo:ro,Z" lychee:<version>-rhhi .

# Configurable formats
podman run --rm -v "$(pwd):/repo:ro,Z" lychee:<version>-rhhi 'docs/**/*.md' 'README.md'

# JSON output for CI integration
podman run --rm -v "$(pwd):/repo:ro,Z" lychee:<version>-rhhi --format json --output /tmp/links.json .

# Restrict to internal-only (skip external URLs entirely — air-gap-friendly default)
podman run --rm -v "$(pwd):/repo:ro,Z" lychee:<version>-rhhi --offline --include-fragments .

# Use a config file from the repo root
podman run --rm -v "$(pwd):/repo:ro,Z" lychee:<version>-rhhi --config lychee.toml .

⁠Config example (lychee.toml at repo root)

# Skip the loud-and-noisy ones
exclude = [
  'https://example\.com',
  '^http://localhost',
]
# Treat timeouts as success — useful in air-gap where slow internal hosts are normal
accept = [200, 301, 302, 308]
max_redirects = 5
timeout = 20

⁠Supply chain

• Base images: registry.access.redhat.com/hi/rust (build) → registry.access.redhat.com/hi/core-runtime (runtime)
• Built from: upstream source at the pinned commit
• Tier: rust (first Rust tool in this rebase line — Containerfile.rust template lives under containerfiles/_template/)
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation