chore: merge audit fixes (tests)

.github/workflows/validate.yml

@@ -17,6 +17,17 @@ on:
       - "install.py"
       - "install.sh"
       - "install.ps1"
+      # Every input of the site build, so a page that would fail the deploy
+      # fails here first (tests/test_workflow_paths.py).
+      - "wiki/**"
+      - "docs_assets/**"
+      - "provenance/**"
+      - "exports/**"
+      - "install/**"
+      - "database.json"
+      - "release.json"
+      - "derivable.json"
+      - "mkdocs.yml"
   # Spelled out twice because the workflow parser reads no YAML anchor. A test
   # holds the two lists equal.
   push:
@@ -31,6 +42,15 @@ on:
       - "install.py"
       - "install.sh"
       - "install.ps1"
+      - "wiki/**"
+      - "docs_assets/**"
+      - "provenance/**"
+      - "exports/**"
+      - "install/**"
+      - "database.json"
+      - "release.json"
+      - "derivable.json"
+      - "mkdocs.yml"
 
 permissions:
   contents: read
@@ -190,9 +210,10 @@ jobs:
             3.12
 
       # markdown: the site validation test renders a wiki line to prove the
-      # heading guard's premise, and skipped on every run without it.
+      # heading guard's premise, and skipped on every run without it. The docs
+      # group builds the site as deploy-site.yml does, with the same bounds.
       - name: Install dependencies
-        run: pip install pyyaml "jsonschema[format-nongpl]==4.26.0" "markdown==3.10.2"
+        run: pip install pyyaml "jsonschema[format-nongpl]==4.26.0" "markdown==3.10.2" "mkdocs-material>=9.7.5,<10" "pymdown-extensions>=10.14"
 
       # The exporter fidelity cases compare what we hand back against the
       # file each platform publishes, so they need those files. They skip
@@ -218,6 +239,17 @@ jobs:
           RETROBIOS_OFFLINE: "1"
         run: python -m unittest discover -s tests -t . -v
 
+      # deploy-site.yml runs this after the merge, and a dead link or a stray
+      # heading failed it there with nothing in front of it. Run whatever the
+      # suite returned, so one red step does not hide the other. The release
+      # assets are not restored: they change counts, not links or headings.
+      - name: Build the site
+        if: ${{ !cancelled() }}
+        run: |
+          python scripts/generate_site.py
+          mkdocs build --strict
+          python scripts/validate_site.py
+
   label-pr:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'