ci: maintain wheel smoke and versioned adapter dependency

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      actions:
+        patterns: ["*"]
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      dependencies:
+        patterns: ["*"]
+  - package-ecosystem: "pip"
+    directory: "/examples/entitylinkage-coverage"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 1

.github/workflows/ci.yml

@@ -38,9 +38,15 @@ jobs:
       - name: Install built wheel
         run: |
           python -m venv "$RUNNER_TEMP/package-venv"
-          "$RUNNER_TEMP/package-venv/bin/python" -m pip install dist/evidencematrix-0.1.1-py3-none-any.whl entitylinkage==0.1.0
-          "$RUNNER_TEMP/package-venv/bin/evidencematrix" validate examples/basic
-          PATH="$RUNNER_TEMP/package-venv/bin:$PATH" bash examples/entitylinkage-coverage/run-example.sh "$RUNNER_TEMP/entitylinkage-coverage-example"
+          shopt -s nullglob
+          wheels=(dist/*.whl)
+          test "${#wheels[@]}" -eq 1
+          "$RUNNER_TEMP/package-venv/bin/python" -m pip install "${wheels[0]}" -r examples/entitylinkage-coverage/requirements.txt
+          export PATH="$RUNNER_TEMP/package-venv/bin:$PATH"
+          cd "$RUNNER_TEMP"
+          python -c 'import evidencematrix, pathlib; assert "site-packages" in pathlib.Path(evidencematrix.__file__).resolve().parts'
+          evidencematrix validate "$GITHUB_WORKSPACE/examples/basic"
+          bash "$GITHUB_WORKSPACE/examples/entitylinkage-coverage/run-example.sh" "$RUNNER_TEMP/entitylinkage-coverage-example"
       - name: CLI smoke test
         shell: bash
         run: |

.github/workflows/publish.yml

@@ -26,6 +26,15 @@ jobs:
         run: |
           package_version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
           test "$GITHUB_REF_NAME" = "v$package_version"
+      - name: Test locked release source
+        env:
+          PYTHONPATH: src
+        run: |
+          set -euo pipefail
+          uv sync --locked --all-groups --no-install-project --no-build
+          uv run --locked --no-sync --no-build ruff check .
+          uv run --locked --no-sync --no-build ruff format --check .
+          uv run --locked --no-sync --no-build pytest
       - name: Build distributions
         run: uv build
       - name: Check distribution metadata
@@ -55,4 +64,4 @@ jobs:
           name: release-dists
           path: dist/
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

MANIFEST.in

@@ -1,2 +1,2 @@
 include LICENSE README.md
-recursive-include examples *.yaml *.md *.json *.csv *.py *.sh
+recursive-include examples *.yaml *.md *.json *.csv *.py *.sh *.txt

README.md

@@ -127,3 +127,7 @@ The [synthetic integration example](examples/entitylinkage-coverage/README.md) d
 ## License
 
 EvidenceMatrix is distributed under the [Apache License 2.0](LICENSE).
+
+## Maintenance
+
+See [maintenance conventions](docs/maintenance.md) for dependency updates, required CI, Action pinning and release validation.

docs/maintenance.md

@@ -0,0 +1,11 @@
+# Maintenance
+
+Dependency and GitHub Actions updates are proposed weekly by Dependabot (the native `uv` ecosystem maintains `uv.lock`), with grouped updates and a small open-PR limit. Review behavior changes and merge only after required CI passes; automatic merging and mandatory human approvals are not configured.
+
+External Actions are pinned to verified full commit SHAs with readable version comments. Update the SHA and comment together. Pinning an Action implementation does not freeze a Rust stable toolchain or every transitive package; committed lockfiles define the resolved test dependencies. Isolated build-backend requirements and clean-wheel consumer dependencies can still resolve separately; these checks do not assert bitwise reproducible builds.
+
+Main should reject force pushes and deletion and require a pull request with the always-running CI checks listed below. No human approval is required. Required checks must not use workflow-level PR path filters, which can leave documentation or dependency PRs pending indefinitely. Keep check names stable or migrate the ruleset when changing them.
+
+Release tags must match package and Action binary versions where applicable. Validate tests, build artifacts, metadata and clean installs before publishing. Python packages use PyPI Trusted Publishing; binary Actions verify the selected release archive against its SHA256SUMS before running it. Never replace assets on an already published release. Versioned integration dependencies are updated explicitly and compatibility is checked before adoption.
+
+Required CI: `Python 3.11`, `Python 3.12` and `Python 3.13`. CI installs the built wheel and runs the EntityLinkage coverage adapter with the version in `examples/entitylinkage-coverage/requirements.txt`. Ambiguous and unresolved links remain review findings; missing relationships remain unknown without an explicit coverage declaration.

examples/entitylinkage-coverage/README.md

@@ -7,7 +7,7 @@ This fully synthetic example links fictional external catalog records to a small
 Install the two standalone tools:
 
 ```bash
-python -m pip install 'entitylinkage==0.1.0' 'evidencematrix==0.1.1'
+python -m pip install -r examples/entitylinkage-coverage/requirements.txt 'evidencematrix==0.1.1'
 bash examples/entitylinkage-coverage/run-example.sh
 ```
 

examples/entitylinkage-coverage/requirements.txt

@@ -0,0 +1 @@
+entitylinkage==0.1.1