ci: deploy docs as part of a dispatched release

.github/workflows/release-docs.yaml

@@ -1,9 +1,19 @@
 name: Docs
 
 on:
+  # Kept for a tag pushed by a human. A release cut through release.yaml pushes
+  # its tag with GITHUB_TOKEN, and GitHub does not start workflows from events
+  # that token creates - so release.yaml calls this workflow directly instead.
   push:
     tags:
       - "*"
+  workflow_call:
+    inputs:
+      environment:
+        description: 'Deployment environment'
+        required: false
+        default: 'production'
+        type: string
   workflow_dispatch:
     inputs:
       environment:
@@ -31,7 +41,7 @@ jobs:
       - name: Deploy to Cloudflare Pages
         uses: flowexec/action@v1
         with:
-          executable: "deploy docs:cloudflare ${{ github.event.inputs.environment || 'production' }}"
+          executable: "deploy docs:cloudflare ${{ inputs.environment || 'production' }}"
           timeout: '5m'
           flow-version: 'main'
           secrets: |

.github/workflows/release.yaml

@@ -61,3 +61,17 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HOMEBREW_FLOW_GITHUB_TOKEN: ${{ secrets.HOMEBREW_FLOW_GITHUB_TOKEN }}
+
+  # Publishing the docs is part of releasing: the site serves the JSON schemas
+  # that editors validate flowfiles against, so skipping it ships a release whose
+  # schema the world cannot see. This runs here rather than off the tag push
+  # because a tag pushed with GITHUB_TOKEN does not trigger workflows.
+  release-docs:
+    needs: release-binary
+    # Only for a dispatched release. A tag pushed by a human triggers
+    # release-docs.yaml on its own, and calling it here too would deploy twice.
+    if: github.event_name == 'workflow_dispatch'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/release-docs.yaml
+    secrets: inherit