From d5806b1ecb8a01926ad44184041ab6f08f8a297d Mon Sep 17 00:00:00 2001
From: Jahvon Dockery <jahvondockery@gmail.com>
Date: Thu, 27 Aug 2026 02:35:03 -0400
Subject: [PATCH] ci: deploy docs as part of a dispatched release

The published JSON schemas have been stale since 2026-05-02, so editors have
been validating flowfiles against a schema that predates the container feature
(#407, merged 2026-07-22) despite two releases shipping since.

release-docs.yaml only listens on push:tags. Releases stopped arriving that way:
v2.1.0 and v2.1.1 were both cut by dispatching release.yaml, which creates and
pushes the tag itself using GITHUB_TOKEN. GitHub does not start workflows from
events that token creates, so the tag push was invisible and the docs never
deployed. The last successful run was a manual dispatch.

release-docs.yaml becomes callable and release.yaml calls it after the binary
publishes, so the site is updated by the same run that cuts the release. The
call is limited to dispatched releases; a tag pushed by a human still triggers
release-docs.yaml directly, and calling it in both paths would deploy twice.

The environment now reads from `inputs`, which is populated for both a call and
a dispatch, rather than from github.event.inputs, which is only set for a
dispatch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R328pa3FUUfga4gYah1iQi
---
 .github/workflows/release-docs.yaml | 12 +++++++++++-
 .github/workflows/release.yaml      | 14 ++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release-docs.yaml b/.github/workflows/release-docs.yaml
index 020b7708..1c2ad6f9 100644
--- a/.github/workflows/release-docs.yaml
+++ b/.github/workflows/release-docs.yaml
@@ -1,9 +1,19 @@
 name: Docs
 
 on:
+  # Kept for a tag pushed by a human. A release cut through release.yaml pushes
+  # its tag with GITHUB_TOKEN, and GitHub does not start workflows from events
+  # that token creates - so release.yaml calls this workflow directly instead.
   push:
     tags:
       - "*"
+  workflow_call:
+    inputs:
+      environment:
+        description: 'Deployment environment'
+        required: false
+        default: 'production'
+        type: string
   workflow_dispatch:
     inputs:
       environment:
@@ -31,7 +41,7 @@ jobs:
       - name: Deploy to Cloudflare Pages
         uses: flowexec/action@v1
         with:
-          executable: "deploy docs:cloudflare ${{ github.event.inputs.environment || 'production' }}"
+          executable: "deploy docs:cloudflare ${{ inputs.environment || 'production' }}"
           timeout: '5m'
           flow-version: 'main'
           secrets: |
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c5399af2..1778b48e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -61,3 +61,17 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HOMEBREW_FLOW_GITHUB_TOKEN: ${{ secrets.HOMEBREW_FLOW_GITHUB_TOKEN }}
+
+  # Publishing the docs is part of releasing: the site serves the JSON schemas
+  # that editors validate flowfiles against, so skipping it ships a release whose
+  # schema the world cannot see. This runs here rather than off the tag push
+  # because a tag pushed with GITHUB_TOKEN does not trigger workflows.
+  release-docs:
+    needs: release-binary
+    # Only for a dispatched release. A tag pushed by a human triggers
+    # release-docs.yaml on its own, and calling it here too would deploy twice.
+    if: github.event_name == 'workflow_dispatch'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/release-docs.yaml
+    secrets: inherit