feat(ci): re-run the skill check on main and build the docs on PRs (4/4)

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Changes to CI, the skill publishing check and its rule data (including
+# removed-skills.json) need approval from a repository admin. A pull request
+# runs its own copy of each check, so without this it could edit a check to pass.
+#
+# This takes effect once branch protection turns on "Require review from Code
+# Owners" for main.
+/.github/ @aws/tools-for-devops-agent-admins

.github/workflows/build-docs.yml

@@ -0,0 +1,44 @@
+name: Build docs
+
+# Builds the GitHub Pages site with `mkdocs build --strict` on every pull
+# request, so a change that would break the site is caught before it merges
+# rather than by deploy-docs.yml after it. It only builds; it deploys nothing and
+# doesn't change the site.
+#
+# mkdocs-material is pinned to the same version deploy-docs.yml installs, so a
+# pull request builds the site exactly as the deploy does.
+#
+# NOTE: advisory until an admin adds "build-docs" to the required status checks
+# for `main`.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    # Deliberately NOT filtered with `paths:`: a required check that never runs
+    # stays pending forever.
+
+permissions:
+  contents: read
+
+concurrency:
+  group: build-docs-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  build-docs:
+    name: build-docs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Install mkdocs
+        run: python3 -m pip install mkdocs-material==9.6.14
+
+      - name: Build the site
+        run: mkdocs build --strict

.github/workflows/validate-skills-main.yml

@@ -0,0 +1,54 @@
+name: Validate skills on main
+
+# Runs the skill publishing check again after every push to `main`.
+#
+# The pull request check (validate-skills.yml) is exact only for the base commit
+# it ran on. Two pull requests that each passed on an older base can break the
+# rules together once both merge, for example by bumping one skill to the same
+# version. Skills on `main` are published as one set, so such a break stops every
+# skill from publishing; this run reports it as soon as it lands, against the
+# commit `main` pointed at before the push.
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: validate-skills-main
+  cancel-in-progress: false
+
+jobs:
+  validate-skills-main:
+    name: validate-skills-main
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Install the pinned dependencies
+        run: python3 -m pip install --require-hashes -r .github/scripts/skill-rules/requirements.txt
+
+      - name: Check every skill against the previous main
+        env:
+          BEFORE: ${{ github.event.before }}
+        run: |
+          # `before` is all zeros when the branch is new, and may be missing
+          # after a force push; fall back to the parent commit, and to a check
+          # without a base when there is none.
+          if [ -z "${BEFORE//0/}" ] || ! git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
+            BEFORE="$(git rev-parse --verify --quiet HEAD^ || true)"
+          fi
+          if [ -n "${BEFORE}" ]; then
+            python3 .github/scripts/validate_skills.py --base-ref "${BEFORE}" --head-ref HEAD
+          else
+            python3 .github/scripts/validate_skills.py --head-ref HEAD
+          fi