github token

Author: clavery

.github/workflows/deploy-docs.yml

@@ -54,35 +54,17 @@ jobs:
       - name: Get latest release tag
         id: release
         run: |
-          # Find the highest-versioned package tag and docs tag (by semver, not
-          # creation date) so that maintenance patches on older minors never
-          # cause stable docs to regress to an older codebase.
-          pick_highest() {
-            node -e "
-              const lines = require('fs').readFileSync('/dev/stdin','utf8').trim().split('\n').filter(Boolean);
-              const parsed = lines.map(tag => {
-                const ver = tag.split('@').pop();
-                const [major, minor, patch] = ver.split('.').map(Number);
-                return { tag, major, minor, patch };
-              }).filter(t => !isNaN(t.major));
-              parsed.sort((a, b) => b.major - a.major || b.minor - a.minor || b.patch - a.patch);
-              if (parsed.length) console.log(parsed[0].tag);
-            "
-          }
-
-          PKG_TAG=$(git tag --list '@salesforce/*' | pick_highest)
-          DOCS_TAG=$(git tag --list 'docs@*' | pick_highest)
-
-          # Pick whichever tag has the higher semver version
+          # Find the most recent package tag and docs tag by creation date.
+          # This is safe because only @latest publishes and doc-only releases
+          # trigger this workflow — maintenance patches on older minors are
+          # excluded by the publish workflow gate.
+          PKG_TAG=$(git tag --list '@salesforce/*' --sort=-creatordate | head -n1)
+          DOCS_TAG=$(git tag --list 'docs@*' --sort=-creatordate | head -n1)
+
+          # Pick whichever tag was created more recently
           LATEST_TAG=""
           if [[ -n "$PKG_TAG" && -n "$DOCS_TAG" ]]; then
-            WINNER=$(node -e "
-              const a = '${PKG_TAG}'.split('@').pop().split('.').map(Number);
-              const b = '${DOCS_TAG}'.split('@').pop().split('.').map(Number);
-              const cmp = a[0]-b[0] || a[1]-b[1] || a[2]-b[2];
-              console.log(cmp >= 0 ? '${PKG_TAG}' : '${DOCS_TAG}');
-            ")
-            LATEST_TAG="$WINNER"
+            LATEST_TAG=$(git tag --list '@salesforce/*' --list 'docs@*' --sort=-creatordate | head -n1)
           elif [[ -n "$PKG_TAG" ]]; then
             LATEST_TAG="$PKG_TAG"
           elif [[ -n "$DOCS_TAG" ]]; then

.github/workflows/publish.yml

@@ -29,6 +29,7 @@ jobs:
       github.event_name != 'workflow_run' ||
       github.event.workflow_run.conclusion == 'success'
     permissions:
+      actions: write # For triggering deploy-docs.yml via workflow_dispatch
       contents: write # For creating GitHub releases and tags
       id-token: write # Required for npm OIDC trusted publishers
       pull-requests: write # For creating merge-back PRs
@@ -339,7 +340,9 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Trigger documentation deployment
-        if: steps.release-type.outputs.type == 'stable' && steps.changesets.outputs.skip != 'true' && steps.quick-check.outputs.skip != 'true'
+        if: >-
+          steps.release-type.outputs.type == 'stable' && steps.changesets.outputs.skip != 'true' && steps.quick-check.outputs.skip != 'true'
+          && (steps.packages.outputs.tag_cli == 'latest' || steps.packages.outputs.tag_sdk == 'latest' || steps.packages.outputs.tag_mcp == 'latest' || steps.packages.outputs.publish_docs == 'true')
         run: gh workflow run deploy-docs.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

PUBLISHING.md

@@ -152,7 +152,7 @@ The documentation site serves two versions:
 - **Stable** (root URL) — built from the most recent release tag (across all branches)
 - **Dev** (`/dev/`) — built from `main`, updated on every push
 
-Stable docs are rebuilt after every stable or release branch publish. The `deploy-docs.yml` workflow builds from the highest semver release tag, so stable docs always reflect the latest release line. Maintenance patches on older minors do not affect stable docs.
+Stable docs are rebuilt only when a package publishes to `@latest` (hotfix from the current minor or a regular release) or when a doc-only release is created. Maintenance patches on older minors (which publish to scoped dist-tags like `@release-0.4`) do not trigger a docs rebuild.
 
 ## Local Testing