ci: qualify commit-bound Specs releases

.github/workflows/ci.yml

@@ -31,13 +31,13 @@ jobs:
         run: uv python install ${{ env.PYTHON_VERSION }}
 
       - name: Install dependencies
-        run: uv sync --python ${{ env.PYTHON_VERSION }} --dev
+        run: uv sync --locked --python ${{ env.PYTHON_VERSION }} --dev
 
       - name: Run ruff check
-        run: uv run ruff check src/ tests/
+        run: uv run ruff check src/ tests/ scripts/
 
       - name: Run ruff format check
-        run: uv run ruff format --check src/ tests/
+        run: uv run ruff format --check src/ tests/ scripts/
 
   typecheck:
     name: Type Check
@@ -54,7 +54,7 @@ jobs:
         run: uv python install ${{ env.PYTHON_VERSION }}
 
       - name: Install dependencies
-        run: uv sync --python ${{ env.PYTHON_VERSION }} --dev
+        run: uv sync --locked --python ${{ env.PYTHON_VERSION }} --dev
 
       - name: Run ty check
         run: uv run ty check
@@ -110,7 +110,7 @@ jobs:
           allow-prereleases: true
 
       - name: Install dependencies
-        run: uv sync --python python --dev
+        run: uv sync --locked --python python --dev
 
       - name: Import package
         run: uv run --python python python -c "import ml4t.specs"

.github/workflows/docs.yml

@@ -3,48 +3,54 @@ name: Docs
 on:
   push:
     branches: [main]
+  pull_request:
+    branches: [main]
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 concurrency:
-  group: docs
+  group: docs-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  PYTHON_VERSION: "3.12"
+
 jobs:
   build:
-    name: Build and deploy docs
+    name: Build revision-identified documentation
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "0.10.9"
-
-      - name: Set up Python
-        run: uv python install 3.12
-
-      - name: Install dependencies
-        run: uv sync --python 3.12 --dev --extra docs
-
-      - name: Build docs
-        run: uv run mkdocs build --strict
-
-      - name: Deploy to website repository
-        uses: cpina/github-action-push-to-another-repository@55306faa4ed53b815ae49e564af8cfb359d32ae2 # v1.7.3
-        env:
-          SSH_DEPLOY_KEY: ${{ secrets.DOCS_DEPLOY_KEY }}
+      - run: uv python install ${{ env.PYTHON_VERSION }}
+      - run: uv sync --locked --python ${{ env.PYTHON_VERSION }} --dev --extra docs
+      - name: Record source identity
+        shell: bash
+        run: |
+          echo "ML4T_DOCS_VERSION=$(uv run python -c 'from ml4t.specs import __version__; print(__version__)')" >> "$GITHUB_ENV"
+          echo "ML4T_DOCS_COMMIT=${GITHUB_SHA}" >> "$GITHUB_ENV"
+      - name: Execute the README quick start
+        run: uv run python scripts/run_readme_quickstart.py
+      - name: Check every README link
+        run: uv run python scripts/check_readme_links.py README.md
+      - name: Build and verify documentation
+        run: |
+          uv run mkdocs build --strict
+          uv run python scripts/verify_documentation_identity.py \
+            --site site \
+            --expected-library specs \
+            --expected-version "$ML4T_DOCS_VERSION" \
+            --expected-commit "$ML4T_DOCS_COMMIT"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          source-directory: site/
-          destination-github-username: ml4t
-          destination-repository-name: website
-          target-directory: static/docs/specs/
-          target-branch: main
-          commit-message: "docs(specs): update from ml4t/specs@${{ github.sha }}"
-          user-name: ml4t-bot
-          user-email: bot@ml4trading.io
+          name: docs-${{ github.sha }}
+          path: site/
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/ecosystem.yml

@@ -17,6 +17,6 @@ jobs:
   qualification:
     permissions:
       contents: read
-    uses: ml4t/ecosystem/.github/workflows/qualify-library.yml@457678d8860d0c816b1dc376e7e2691daa93af4d # v0.1.0
+    uses: ml4t/ecosystem/.github/workflows/qualify-library.yml@da2cbb9a9d0b4d2f166ad630470ff7d7a1aa2643 # 2026-09-19 policy snapshot
     with:
       import-package: ml4t.specs