docs: publish the MkDocs site to GitHub Pages

A Docs workflow builds the site strictly with the docs extra and deploys it to
https://norandom.github.io/OpenUltraSAST/ on pushes to main that touch the docs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

.github/workflows/docs.yml

@@ -0,0 +1,43 @@
+name: Docs
+
+# Builds the MkDocs site and publishes it to GitHub Pages on every push to main that touches it.
+on:
+  push:
+    branches: [main]
+    paths: ["docs/**", "mkdocs.yml", "README.md", ".github/workflows/docs.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - uses: actions/setup-python@v6
+        with:
+          python-version-file: .python-version
+      - run: uv sync --extra docs
+      - run: uv run mkdocs build --strict
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: site
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

README.md

@@ -20,6 +20,9 @@ something, it records a degradation. It does not report a clean result.
 This file is the front door. Each section links to its page of the documentation site (`docs/`,
 `mkdocs.yml`; `uv sync --extra docs && uv run mkdocs serve`).
 
+
+The documentation is published at <https://norandom.github.io/OpenUltraSAST/>; the pages below link to their sources in `docs/`.
+
 ## Status
 
 **v2.0.0, state as of 2026-10-02.** The pre-push safety net is **NO-GO** against every M4 gate.

mkdocs.yml

@@ -1,5 +1,6 @@
 site_name: OpenUltraSAST
 site_description: An experimental static security analyser and repository safety net, with an agentic plane and a learned decision engine in development.
+site_url: https://norandom.github.io/OpenUltraSAST/
 repo_url: https://github.com/norandom/OpenUltraSAST
 edit_uri: edit/main/docs/
 docs_dir: docs