ci(pr-automation): compare APIs using locked dependencies

.github/PR_AUTOMATION.md

@@ -192,6 +192,8 @@ Risk labels express required maintainer scrutiny:
 | `risk/unknown` | No valid classification was available. |
 
 `cargo-semver-checks` incompatibility forces `risk/high`.
+The API check builds baseline and head rustdoc JSON with `cargo rustdoc --locked`,
+so both builds use their committed dependency versions before comparison.
 A model-suspected breaking change promotes `risk/low` to `risk/medium`.
 Path rules can add `scope/core`, `scope/web`, `scope/ffi`, and `scope/tooling`.
 The classifier controls `scope/cross-cutting`, `kind/technical-debt`, and documentation-only classification.

.github/workflows/pr-automation.yml

@@ -403,11 +403,31 @@ jobs:
             CARGO_HOME="$semver_cargo" \
             CARGO_TARGET_DIR="$semver_target" \
             PATH="$rust_bin_dir:$PATH" \
-            "$semver_bin" \
-            --package ironrdp \
-            --only-explicit-features \
-            --features "$CARGO_SEMVER_CHECKS_FEATURES" \
-            --baseline-rev "$BASE_SHA"
+            RUSTC_BOOTSTRAP=1 \
+            RUSTDOCFLAGS="-Z unstable-options --document-private-items --document-hidden-items --output-format=json --cap-lints=allow" \
+            HEAD_SHA="$HEAD_SHA" \
+            BASE_SHA="$BASE_SHA" \
+            SEMVER_BIN="$semver_bin" \
+            SEMVER_FEATURES="$CARGO_SEMVER_CHECKS_FEATURES" \
+            bash -euo pipefail -c '
+              # cargo-semver-checks normally resolves a new dependency graph in a
+              # placeholder crate. Build rustdoc ourselves so both revisions use
+              # their committed lockfiles, just like the ordinary CI build.
+              artifact_root="$CARGO_TARGET_DIR"
+              for revision in baseline current; do
+                if [[ "$revision" == baseline ]]; then
+                  git checkout --detach "$BASE_SHA"
+                else
+                  git checkout --detach "$HEAD_SHA"
+                fi
+                export CARGO_TARGET_DIR="$artifact_root/$revision"
+                cargo rustdoc --locked --package ironrdp --lib \
+                  --no-default-features --features "$SEMVER_FEATURES"
+              done
+              "$SEMVER_BIN" \
+                --current-rustdoc "$artifact_root/current/doc/ironrdp.json" \
+                --baseline-rustdoc "$artifact_root/baseline/doc/ironrdp.json"
+            '
           status=$?
           set -e
           case "$status" in