From e60aa79da26a4f57d76b3a23b4db00aea6e34417 Mon Sep 17 00:00:00 2001 From: Andres Rodriguez Date: Tue, 14 Jul 2026 21:22:57 -0700 Subject: [PATCH 1/2] ci: deploy staging for published release notes --- .github/workflows/deploy-docs-staging.yaml | 9 +++++++++ AGENTS.md | 6 ++++++ 2 files changed, 15 insertions(+) diff --git a/.github/workflows/deploy-docs-staging.yaml b/.github/workflows/deploy-docs-staging.yaml index 38d88dbb4..f9f6348ce 100644 --- a/.github/workflows/deploy-docs-staging.yaml +++ b/.github/workflows/deploy-docs-staging.yaml @@ -1,5 +1,7 @@ name: Deploy docs site to staging +run-name: Deploy docs site to staging | ${{ github.event.client_payload.correlation_id || github.sha }} + on: push: branches: @@ -8,6 +10,8 @@ on: workflows: ["Merge main into staging"] types: - completed + repository_dispatch: + types: [release-notes-published] workflow_dispatch: concurrency: @@ -20,6 +24,7 @@ jobs: if: | github.event_name == 'push' || (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || + github.event_name == 'repository_dispatch' || github.event_name == 'workflow_dispatch' runs-on: ubuntu-latest outputs: @@ -43,6 +48,7 @@ jobs: if: | github.event_name == 'push' || (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || + github.event_name == 'repository_dispatch' || github.event_name == 'workflow_dispatch' runs-on: ubuntu-latest needs: resolve-sources @@ -55,6 +61,9 @@ jobs: - name: Check out documentation repository uses: actions/checkout@v4 with: + # A release-notes publication changes an external source, not this + # repository. Build it against the currently promoted staging tree. + ref: ${{ github.event_name == 'repository_dispatch' && 'staging' || '' }} # The production build predicts the staging-to-prod merge tree and # therefore needs the shared branch history, not a depth-one clone. fetch-depth: 0 diff --git a/AGENTS.md b/AGENTS.md index 3a98ccb3d..414362585 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -67,6 +67,12 @@ Documentation moves through `main` → `staging` → `prod`: 3. The prospective production build runs the complete production-profile validation and uploads an immutable artifact keyed to the exact Git tree that a `staging` → `prod` merge will create. 4. The production workflow deploys only that exact-tree artifact from a successful staging workflow run. If the artifact is missing, expired, or came from another workflow, production deployment must fail before loading AWS credentials or modifying production. +Release-note content is sourced from `validmind/release-notes`, so merging a +release-notes pull request does not create or merge a documentation pull request. +Instead, the release-notes repository dispatches the staging deployment directly; +that deployment uses the current documentation `staging` tree and the latest +release-notes `main` revision. + The merge-queue `validate` bridge does not render the site again. It records that the pull-request revision passed preview validation; the complete production safety boundary is the post-merge staging artifact. ## CI invariants From a9b37e11ee95dd6608fca15dad36ef31006bc2e6 Mon Sep 17 00:00:00 2001 From: Andres Rodriguez Date: Tue, 14 Jul 2026 21:33:15 -0700 Subject: [PATCH 2/2] ci: preserve main-to-staging publication chain --- .github/workflows/deploy-docs-staging.yaml | 9 +-------- .github/workflows/merge-main-into-staging.yaml | 6 +++++- AGENTS.md | 7 ++++--- 3 files changed, 10 insertions(+), 12 deletions(-) diff --git a/.github/workflows/deploy-docs-staging.yaml b/.github/workflows/deploy-docs-staging.yaml index f9f6348ce..872c378bf 100644 --- a/.github/workflows/deploy-docs-staging.yaml +++ b/.github/workflows/deploy-docs-staging.yaml @@ -1,6 +1,6 @@ name: Deploy docs site to staging -run-name: Deploy docs site to staging | ${{ github.event.client_payload.correlation_id || github.sha }} +run-name: Deploy docs site to staging | ${{ github.event.workflow_run.id || github.sha }} on: push: @@ -10,8 +10,6 @@ on: workflows: ["Merge main into staging"] types: - completed - repository_dispatch: - types: [release-notes-published] workflow_dispatch: concurrency: @@ -24,7 +22,6 @@ jobs: if: | github.event_name == 'push' || (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || - github.event_name == 'repository_dispatch' || github.event_name == 'workflow_dispatch' runs-on: ubuntu-latest outputs: @@ -48,7 +45,6 @@ jobs: if: | github.event_name == 'push' || (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || - github.event_name == 'repository_dispatch' || github.event_name == 'workflow_dispatch' runs-on: ubuntu-latest needs: resolve-sources @@ -61,9 +57,6 @@ jobs: - name: Check out documentation repository uses: actions/checkout@v4 with: - # A release-notes publication changes an external source, not this - # repository. Build it against the currently promoted staging tree. - ref: ${{ github.event_name == 'repository_dispatch' && 'staging' || '' }} # The production build predicts the staging-to-prod merge tree and # therefore needs the shared branch history, not a depth-one clone. fetch-depth: 0 diff --git a/.github/workflows/merge-main-into-staging.yaml b/.github/workflows/merge-main-into-staging.yaml index fd825af4e..d132355b1 100644 --- a/.github/workflows/merge-main-into-staging.yaml +++ b/.github/workflows/merge-main-into-staging.yaml @@ -1,9 +1,13 @@ name: Merge main into staging +run-name: Merge main into staging | ${{ github.event.client_payload.correlation_id || github.sha }} + on: push: branches: - main + repository_dispatch: + types: [release-notes-published] permissions: contents: write @@ -77,4 +81,4 @@ jobs: if: ${{ success() && steps.pr-number.outputs.pull-request-number != '' }} run: gh api -X DELETE "repos/${{ github.repository }}/git/refs/heads/update-staging-${{ github.run_id }}" env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/AGENTS.md b/AGENTS.md index 414362585..dd7fa67ec 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -69,9 +69,10 @@ Documentation moves through `main` → `staging` → `prod`: Release-note content is sourced from `validmind/release-notes`, so merging a release-notes pull request does not create or merge a documentation pull request. -Instead, the release-notes repository dispatches the staging deployment directly; -that deployment uses the current documentation `staging` tree and the latest -release-notes `main` revision. +Instead, the release-notes repository dispatches the existing **Merge main into +staging** workflow. Its successful completion triggers the staging deployment, +which builds the promoted documentation tree with the latest release-notes +`main` revision. The merge-queue `validate` bridge does not render the site again. It records that the pull-request revision passed preview validation; the complete production safety boundary is the post-merge staging artifact.