ci: verify every project and publish the docs on GitHub Actions

Two workflows, both running the same targets used locally rather than a
second definition of what "verified" means.

ci.yml discovers the matrix from scripts/verify.sh --list instead of listing
projects, so adding one cannot leave it silently untested -- the same failure
the site-wiring check exists to prevent. Each project runs lint, both type
checkers, tests, and every example; a separate job runs make docs-build.

docs.yml publishes to GitHub Pages on push to main, building with the same
make docs-build, so a page failing the documentation standard is never
published.

The runners have no Docker daemon, which is supported: every example that
wants a real service falls back and prints what the fallback cannot show.

Author: mortenoh

.github/workflows/ci.yml

@@ -0,0 +1,69 @@
+# Verification, run the same way it is run locally.
+#
+# The matrix is discovered rather than listed: scripts/verify.sh --list is the
+# single source of truth for what a project is, so adding one cannot leave it
+# silently untested here.
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  discover:
+    name: discover projects
+    runs-on: ubuntu-latest
+    outputs:
+      projects: ${{ steps.list.outputs.projects }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: list
+        run: |
+          projects="$(./scripts/verify.sh --list | jq -R -s -c 'split("\n") | map(select(length > 0))')"
+          echo "projects=$projects" >> "$GITHUB_OUTPUT"
+          echo "discovered: $projects"
+
+  verify:
+    name: verify ${{ matrix.project }}
+    needs: discover
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        project: ${{ fromJSON(needs.discover.outputs.projects) }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+          cache-dependency-glob: ${{ matrix.project }}/uv.lock
+
+      # lint, both type checkers, tests, and every example. The examples are
+      # deterministic and offline by convention, and anything that wants a
+      # real service falls back and says what the fallback cannot show -- so
+      # a runner with no Docker daemon is a supported way to run them.
+      - run: ./scripts/verify.sh ${{ matrix.project }}
+
+  docs:
+    name: docs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      # Builds the site under --strict, checks every relative link, and
+      # enforces the per-example documentation standard.
+      - run: make docs-build

.github/workflows/docs.yml

@@ -0,0 +1,49 @@
+# Publish the documentation site to GitHub Pages.
+#
+# The build step is `make docs-build`, the same target CI runs, so a page that
+# fails the documentation standard is never published.
+name: publish-docs
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# One deployment at a time, and never cancel one in flight: a half-finished
+# deploy would leave the published site in an undefined state.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - run: make docs-build
+
+      - uses: actions/configure-pages@v5
+
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy.outputs.page_url }}
+    steps:
+      - id: deploy
+        uses: actions/deploy-pages@v4