Deploy docs on version tags and by hand only

.github/workflows/docs.yaml

@@ -1,15 +1,23 @@
 name: docs
 on:
-  # Rebuild after every benchmark run so the charts carry the newest point;
-  # workflow_run fires on the default branch only.
-  workflow_run:
-    workflows: [benchmark]
-    types: [completed]
+  # Deploy on a version tag, so the site describes the released version.
+  # Run by hand (workflow_dispatch) on a pull request's branch to check the
+  # build before merging: that builds without deploying. A manual run on main
+  # redeploys. Not run on every push or pull request commit.
+  # Release order: push the version bump to main as the last commit, wait for
+  # tests and benchmark to finish on it, then tag. The tag's deploy then
+  # includes a benchmark point measured on the released commit.
+  push:
+    tags: ["v*"]
   workflow_dispatch:
 permissions:
   contents: read
   pages: write
   id-token: write
+# One run at a time per ref; a running deploy is never cancelled.
+concurrency:
+  group: pages-${{ github.ref }}
+  cancel-in-progress: false
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -24,11 +32,13 @@ jobs:
           if git fetch --depth=1 origin gh-pages 2>/dev/null && git checkout origin/gh-pages -- dev/bench 2>/dev/null; then
             mkdir -p docs/build/html/dev && mv dev/bench docs/build/html/dev/
           fi
-      - uses: actions/upload-pages-artifact@v3
+      # Only a tag or main deploys; a manual run on another branch is a build check.
+      - if: github.ref_type == 'tag' || github.ref == 'refs/heads/main'
+        uses: actions/upload-pages-artifact@v3
         with:
           path: docs/build/html
   deploy:
-    if: github.ref == 'refs/heads/main'
+    if: github.ref_type == 'tag' || github.ref == 'refs/heads/main'
     needs: build
     environment:
       name: github-pages

.github/workflows/tests.yaml

@@ -32,12 +32,16 @@ jobs:
           --health-retries 5
     env:
       PGUSER: postgres
+      # Every uv command in the job resolves the same way. With the mode given to
+      # `uv sync` alone, the later `uv run` re-resolved to the newest versions and
+      # the lowest-direct leg never tested the declared floors.
+      UV_RESOLUTION: ${{ matrix.resolution }}
     steps:
       - uses: actions/checkout@v4
       - uses: astral-sh/setup-uv@v6
         with:
           python-version: ${{ matrix.python-version }}
-      - run: uv sync --resolution ${{ matrix.resolution }}
+      - run: uv sync
       - name: tests
         run: |
           start=$(date +%s%N)