fix(docs): publish only released documentation

3 files changed, 57 insertions, 11 deletions

diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index 6704505b..158f2462 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -57,8 +57,8 @@ jobs:
             commit="$(python3 scripts/preview.py select-commit --ref origin/master)"
           fi
           current_preview="$(python3 scripts/preview.py current-commit --manifest website/preview.json || true)"
-          if [ "$current_preview" = "$commit" ]; then
-            echo "Preview already points at $commit; skipping."
+          if [ "$current_preview" = "$commit" ] && node website/scripts/docs-preview.mjs check; then
+            echo "Preview and documentation already point at $commit; skipping."
             echo "should_publish=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
@@ -286,6 +286,9 @@ jobs:
     needs: [preflight, build]
     if: needs.preflight.outputs.should_publish == 'true'
     runs-on: ubuntu-latest
+    concurrency:
+      group: docs-publish-master
+      cancel-in-progress: false
     permissions:
       contents: write
       issues: write
@@ -301,6 +304,11 @@ jobs:
         with:
           path: artifacts
 
+      - name: Install Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
       - name: Record previous preview commit
         id: previous-preview
         shell: bash
@@ -353,8 +361,9 @@ jobs:
             artifacts/herdr-macos-aarch64/herdr-macos-aarch64
             artifacts/herdr-windows-x86_64.zip/herdr-windows-x86_64.zip
 
-      - name: Update preview manifest
+      - name: Update preview documentation and manifest
         run: |
+          node website/scripts/docs-preview.mjs snapshot '${{ needs.preflight.outputs.commit }}'
           python3 scripts/preview.py manifest \
             --output website/preview.json \
             --tag '${{ needs.preflight.outputs.tag }}' \
@@ -366,18 +375,22 @@ jobs:
             --notes PREVIEW_NOTES.md \
             --sha-file preview-sha256.json \
             --retain 30
+          (cd website && bun install --frozen-lockfile)
 
-      - name: Commit preview manifest
+      - name: Commit preview publication
         env:
           KANGAL_GITHUB_TOKEN: ${{ secrets.KANGAL_GITHUB_TOKEN }}
         run: |
           git config user.name "kangal-bot"
           git config user.email "285672167+kangal-bot@users.noreply.github.com"
-          git add website/preview.json
-          git diff --cached --quiet || git commit -m "docs: update preview manifest"
+          git add -A docs/preview website/preview.json
+          git diff --cached --quiet || git commit -m "docs: publish preview documentation"
           remote="https://x-access-token:${KANGAL_GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           for attempt in 1 2 3; do
             git pull --rebase "$remote" master
+            node website/scripts/docs-preview.mjs check
+            node website/scripts/docs-versions.mjs check
+            (cd website && bun run build)
             if git push "$remote" HEAD:master; then
               exit 0
             fi
@@ -386,9 +399,20 @@ jobs:
               sleep $((attempt * 2))
             fi
           done
-          echo "failed to publish preview manifest after 3 attempts" >&2
+          echo "failed to publish preview documentation after 3 attempts" >&2
           exit 1
 
+      - name: Trigger website deploy
+        env:
+          DEPLOY_HOOK: ${{ secrets.CLOUDFLARE_PAGES_DEPLOY_HOOK }}
+        run: |
+          if [ -z "$DEPLOY_HOOK" ]; then
+            echo "CLOUDFLARE_PAGES_DEPLOY_HOOK not set; relying on Cloudflare git auto-deploy"
+            exit 0
+          fi
+          curl -fsS -X POST "$DEPLOY_HOOK" > /dev/null
+          echo "Triggered Cloudflare Pages production deploy"
+
       - name: Mark preview-released issues
         continue-on-error: true
         shell: bash
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2fe55021..75a2ffed 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -163,11 +163,17 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Install Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
       - name: Validate release inputs
         run: |
           python3 scripts/changelog.py validate-product-announcement
           test -f docs/next/README.md
           test -f docs/next/README.zh-CN.md
+          (cd website && bun install --frozen-lockfile && bun run test && bun run build:draft)
 
   release:
     needs: [build, flake-check, validate-release-inputs]
@@ -335,6 +341,9 @@ jobs:
   update-latest-json:
     needs: release
     runs-on: ubuntu-latest
+    concurrency:
+      group: docs-publish-master
+      cancel-in-progress: false
     permissions:
       contents: write
 
@@ -363,6 +372,11 @@ jobs:
           python3 scripts/changelog.py validate-product-announcement --path "$ANNOUNCEMENT_PATH"
           RELEASE_PROTOCOL=$(git show "${GITHUB_REF_NAME}:src/protocol/wire.rs" | python3 -c 'import re, sys; match = re.search(r"pub const PROTOCOL_VERSION: u32 = (\d+);", sys.stdin.read()); sys.exit(1) if match is None else print(match.group(1))')
 
+          DOCS_CURRENT=$(node website/scripts/docs-versions.mjs current)
+          if [ "$DOCS_CURRENT" != "$VERSION" ]; then
+            echo "Archived v$VERSION documentation without moving current docs backward from v$DOCS_CURRENT"
+            exit 0
+          fi
           CURRENT_VERSION=$(python3 -c 'import json; print(json.load(open("website/latest.json")).get("version", ""))')
           if [ "$CURRENT_VERSION" = "$VERSION" ]; then
             echo "website/latest.json is already at v$VERSION"
@@ -380,11 +394,12 @@ jobs:
           VERSION="${GITHUB_REF_NAME#v}"
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add README.md README.zh-CN.md docs/versions website/latest.json website/src/content/docs website/src/data/config-reference.json docs/next/product-announcement.json
+          git add -A README.md README.zh-CN.md docs/versions website/latest.json website/src/content/docs website/src/data/config-reference.json docs/next/product-announcement.json
           git diff --cached --quiet || git commit -m "docs: update website manifest for v$VERSION"
           for attempt in 1 2 3; do
             git pull --rebase origin master
             node website/scripts/docs-versions.mjs check
+            node website/scripts/docs-preview.mjs check
             (cd website && bun install --frozen-lockfile && bun run build)
             if git push origin master; then
               exit 0
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index 4cc922d8..4c1be29c 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -6,6 +6,7 @@ on:
       - ".github/workflows/website.yml"
       - "website/**"
       - "docs/next/website/**"
+      - "docs/preview/**"
       - "docs/versions/**"
       - "scripts/test_preview.py"
   push:
@@ -14,6 +15,7 @@ on:
       - ".github/workflows/website.yml"
       - "website/**"
       - "docs/next/website/**"
+      - "docs/preview/**"
       - "docs/versions/**"
       - "scripts/test_preview.py"
 
@@ -40,8 +42,13 @@ jobs:
         with:
           bun-version: 1.3.14
 
-      - name: Validate version snapshots
-        run: node website/scripts/docs-versions.mjs check
+      - name: Validate published snapshots
+        run: |
+          node website/scripts/docs-versions.mjs check
+          node website/scripts/docs-preview.mjs check
 
-      - name: Build website
+      - name: Build published website
         run: cd website && bun install --frozen-lockfile && bun run build
+
+      - name: Validate unpublished draft
+        run: cd website && bun run build:draft