From d87d0f0b4cb739e04e2b4e44f31ffe2407ab63d2 Mon Sep 17 00:00:00 2001 From: Florian-mfr Date: Sat, 10 Oct 2026 15:21:16 +0200 Subject: [PATCH] ci(release): ask the website to rebuild once the release exists spawner.run builds its docs from the latest release, at a daily run that GitHub also stops after 60 days without activity in its repository. Once the GitHub release of a stable version exists, the release job sends it a repository_dispatch (spawner-release), with SITE_DISPATCH_TOKEN: a secret of the release environment, so that only that job reads it, holding a fine-grained token limited to Flosk6/spawner-site (Contents in read and write, which repository_dispatch needs). Without the token, or once it expires, the step says so and the release goes on. --- .github/workflows/release.yml | 19 +++++++++++++++++++ docs/architecture.md | 2 +- scripts/README.md | 7 ++++++- 3 files changed, 26 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9e806d9..a62813a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,6 +10,13 @@ name: Release # of its image, so that it installs what this workflow built. # scripts/release.sh prepares the versions and the tag. # +# Once the GitHub release of a stable version exists, the release job asks +# the website (Flosk6/spawner-site) to rebuild, since it builds its docs from +# the latest release. It does so with SITE_DISPATCH_TOKEN, a secret of the +# "release" environment: a fine-grained token that can write the contents of +# that repository only (repository_dispatch needs it), which no other job +# reads. Without it, the website follows at its daily build. +# # Once npm has a stable version, its server.json goes to the official MCP # Registry, which trusts this repository's OIDC token for the names # io.github.Flosk6/* (the owner's case: the registry compares it as is). That @@ -324,6 +331,18 @@ jobs: gh release create "v$VERSION" release/install.sh release/spawner release/SHA256SUMS \ --title "Spawner $VERSION" --notes-file release/notes.md \ ${{ needs.version.outputs.prerelease == 'true' && '--prerelease' || '--latest' }} + - name: Ask spawner.run to rebuild its docs + if: env.PRERELEASE == 'false' + continue-on-error: true + env: + SITE_DISPATCH_TOKEN: ${{ secrets.SITE_DISPATCH_TOKEN }} + run: | + if [ -z "$SITE_DISPATCH_TOKEN" ]; then + echo "::notice::no SITE_DISPATCH_TOKEN: spawner.run follows this release at its daily build" + exit 0 + fi + GH_TOKEN="$SITE_DISPATCH_TOKEN" gh api --method POST repos/Flosk6/spawner-site/dispatches \ + -f event_type=spawner-release -f "client_payload[version]=$VERSION" mcp-registry: name: MCP server on the MCP Registry diff --git a/docs/architecture.md b/docs/architecture.md index e57ba1a..5235f61 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -263,4 +263,4 @@ Messages for people go to stderr and results to stdout (only JSON with `--json`) ## Releases -`scripts/release.sh` versions and tags a release, and a tag starts `.github/workflows/release.yml`: images on GHCR for amd64 and arm64, the CLI on npm through trusted publishing, and a GitHub release with `install.sh` (the digest of the image written into it), the CLI bundle and their checksums; the images, `install.sh` and the bundle get build provenance attestations. See [scripts](../scripts/README.md#releasesh). +`scripts/release.sh` versions and tags a release, and a tag starts `.github/workflows/release.yml`: images on GHCR for amd64 and arm64, the CLI on npm through trusted publishing, and a GitHub release with `install.sh` (the digest of the image written into it), the CLI bundle and their checksums; the images, `install.sh` and the bundle get build provenance attestations, and the website is asked to rebuild its docs. See [scripts](../scripts/README.md#releasesh). diff --git a/scripts/README.md b/scripts/README.md index b2031a7..cee850e 100644 --- a/scripts/README.md +++ b/scripts/README.md @@ -104,7 +104,12 @@ publishes the images on GHCR (`linux/amd64`, `linux/arm64`), the CLI on npm (`spawner-cli`) and the GitHub release with `install.sh`, the CLI bundle and their checksums. The published `install.sh` gets the digest of the image (`IMAGE_DIGEST`, empty in the repository) unless it is a prerelease, and the -images, `install.sh` and the bundle get build provenance attestations. +images, `install.sh` and the bundle get build provenance attestations. For a stable +version, the release job then asks the website (`Flosk6/spawner-site`) to +rebuild its docs at once, with `SITE_DISPATCH_TOKEN`, a secret of the `release` +environment: a fine-grained token limited to that repository, with Contents +in read and write. Without it, or once it expires, the website follows at its +daily build, and the release goes on. npm publishes through trusted publishing: the settings of the `spawner-cli` package on npmjs.com trust this repository's `release.yml`, so no token is