ci: tighten CI/CD pipeline

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/main.yml

@@ -67,3 +67,19 @@ jobs:
 
       - name: Check if documentation can be built
         run: uv run mkdocs build -s
+
+  deploy-docs:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: [quality, tests-and-type-check, check-docs]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+
+      - name: Set up the environment
+        uses: ./.github/actions/setup-python-env
+
+      - name: Deploy documentation
+        run: uv run mkdocs gh-deploy --force

.github/workflows/on-release-main.yml

@@ -5,62 +5,19 @@ on:
     types: [published]
 
 jobs:
-
-  set-version:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Export tag
-        id: vars
-        run: echo tag=${GITHUB_REF#refs/*/} >> $GITHUB_OUTPUT
-        if: ${{ github.event_name == 'release' }}
-
-      - name: Update project version
-        run: |
-          sed -i "s/^version = \".*\"/version = \"$RELEASE_VERSION\"/" pyproject.toml
-        env:
-          RELEASE_VERSION: ${{ steps.vars.outputs.tag }}
-        if: ${{ github.event_name == 'release' }}
-
-      - name: Upload updated pyproject.toml
-        uses: actions/upload-artifact@v4
-        with:
-          name: pyproject-toml
-          path: pyproject.toml
-
   publish:
     runs-on: ubuntu-latest
-    needs: [set-version]
     steps:
       - name: Check out
         uses: actions/checkout@v4
 
       - name: Set up the environment
         uses: ./.github/actions/setup-python-env
 
-      - name: Download updated pyproject.toml
-        uses: actions/download-artifact@v4
-        with:
-          name: pyproject-toml
-
       - name: Build package
         run: uv build
 
       - name: Publish package
         run: uv publish
         env:
           UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}
-
-  deploy-docs:
-    needs: publish
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out
-        uses: actions/checkout@v4
-
-      - name: Set up the environment
-        uses: ./.github/actions/setup-python-env
-
-      - name: Deploy documentation
-        run: uv run mkdocs gh-deploy --force

docs/plans/2026-02-22-ci-cd-design.md

@@ -0,0 +1,54 @@
+# CI/CD Pipeline Design
+
+## Goal
+
+Tighten the CI/CD pipeline for Litterman: deploy docs on every push to main, simplify the release flow, automate dependency updates, and protect the main branch.
+
+## Changes
+
+### 1. Docs Deployment
+
+Add a `deploy-docs` job to `.github/workflows/main.yml` that runs only on push to main (not on PRs), after all checks pass. Uses `mkdocs gh-deploy --force` to push to the `gh-pages` branch. Requires `contents: write` permission.
+
+Remove the `deploy-docs` job from `on-release-main.yml` since docs now deploy on every main push.
+
+Enable GitHub Pages via `gh api` targeting the `gh-pages` branch.
+
+### 2. Release Script
+
+Add `scripts/release.py` following the cbspy pattern:
+
+- Accepts `patch`, `minor`, or `major` as argument
+- Checks for clean working tree
+- Runs `uv version --bump <type>`
+- Commits `pyproject.toml` and `uv.lock`
+- Tags with `v<version>`
+- Pushes commit and tag
+- Creates GitHub release with `gh release create --generate-notes`
+
+### 3. Simplified Release Workflow
+
+Rewrite `.github/workflows/on-release-main.yml`:
+
+- Remove the `set-version` job and artifact passing (version already correct in committed pyproject.toml)
+- Single `publish` job: checkout, setup env, build with `uv build`, publish with `uv publish`
+
+### 4. Dependabot
+
+Add `.github/dependabot.yml` with weekly updates for:
+
+- `pip` (Python dependencies)
+- `github-actions` (action version bumps)
+
+### 5. Branch Protection
+
+Configure via `gh api`:
+
+- Require status checks to pass: `quality`, `tests-and-type-check`, `check-docs`
+- No review requirement (solo dev)
+- No force pushes to main
+- Allow branch deletion after merge
+
+## Implementation
+
+All changes go on a `ci-improvements` branch off `main`, merged via PR.