ci(release): ask the website to rebuild once the release exists

.github/workflows/release.yml

@@ -10,6 +10,13 @@ name: Release
 # of its image, so that it installs what this workflow built.
 # scripts/release.sh prepares the versions and the tag.
 #
+# Once the GitHub release of a stable version exists, the release job asks
+# the website (Flosk6/spawner-site) to rebuild, since it builds its docs from
+# the latest release. It does so with SITE_DISPATCH_TOKEN, a secret of the
+# "release" environment: a fine-grained token that can write the contents of
+# that repository only (repository_dispatch needs it), which no other job
+# reads. Without it, the website follows at its daily build.
+#
 # Once npm has a stable version, its server.json goes to the official MCP
 # Registry, which trusts this repository's OIDC token for the names
 # io.github.Flosk6/* (the owner's case: the registry compares it as is). That
@@ -324,6 +331,18 @@ jobs:
           gh release create "v$VERSION" release/install.sh release/spawner release/SHA256SUMS \
             --title "Spawner $VERSION" --notes-file release/notes.md \
             ${{ needs.version.outputs.prerelease == 'true' && '--prerelease' || '--latest' }}
+      - name: Ask spawner.run to rebuild its docs
+        if: env.PRERELEASE == 'false'
+        continue-on-error: true
+        env:
+          SITE_DISPATCH_TOKEN: ${{ secrets.SITE_DISPATCH_TOKEN }}
+        run: |
+          if [ -z "$SITE_DISPATCH_TOKEN" ]; then
+            echo "::notice::no SITE_DISPATCH_TOKEN: spawner.run follows this release at its daily build"
+            exit 0
+          fi
+          GH_TOKEN="$SITE_DISPATCH_TOKEN" gh api --method POST repos/Flosk6/spawner-site/dispatches \
+            -f event_type=spawner-release -f "client_payload[version]=$VERSION"
 
   mcp-registry:
     name: MCP server on the MCP Registry

docs/architecture.md

@@ -263,4 +263,4 @@ Messages for people go to stderr and results to stdout (only JSON with `--json`)
 
 ## Releases
 
-`scripts/release.sh` versions and tags a release, and a tag starts `.github/workflows/release.yml`: images on GHCR for amd64 and arm64, the CLI on npm through trusted publishing, and a GitHub release with `install.sh` (the digest of the image written into it), the CLI bundle and their checksums; the images, `install.sh` and the bundle get build provenance attestations. See [scripts](../scripts/README.md#releasesh).
+`scripts/release.sh` versions and tags a release, and a tag starts `.github/workflows/release.yml`: images on GHCR for amd64 and arm64, the CLI on npm through trusted publishing, and a GitHub release with `install.sh` (the digest of the image written into it), the CLI bundle and their checksums; the images, `install.sh` and the bundle get build provenance attestations, and the website is asked to rebuild its docs. See [scripts](../scripts/README.md#releasesh).

scripts/README.md

@@ -104,7 +104,12 @@ publishes the images on GHCR (`linux/amd64`, `linux/arm64`), the CLI on npm
 (`spawner-cli`) and the GitHub release with `install.sh`, the CLI bundle and
 their checksums. The published `install.sh` gets the digest of the image
 (`IMAGE_DIGEST`, empty in the repository) unless it is a prerelease, and the
-images, `install.sh` and the bundle get build provenance attestations.
+images, `install.sh` and the bundle get build provenance attestations. For a stable
+version, the release job then asks the website (`Flosk6/spawner-site`) to
+rebuild its docs at once, with `SITE_DISPATCH_TOKEN`, a secret of the `release`
+environment: a fine-grained token limited to that repository, with Contents
+in read and write. Without it, or once it expires, the website follows at its
+daily build, and the release goes on.
 
 npm publishes through trusted publishing: the settings of the `spawner-cli`
 package on npmjs.com trust this repository's `release.yml`, so no token is