From f851dbd6553e291d09d253117cedc14e49d3513b Mon Sep 17 00:00:00 2001 From: John McCall Date: Mon, 24 Aug 2026 12:44:35 -0400 Subject: [PATCH 01/10] Trigger docs production build on overture-schema release Adds docs-publish.yml: fires on release: published, filtered to the overture-schema umbrella package's release (matching the same special-case release-trigger.yaml already makes for it), and dispatches production_deploy_documentation.yml on OvertureMaps/docs with the release's vanity tag as schema-ref (falling back to the package-prefixed tag if the vanity tag is ever missing). Cross-repo dispatch needs a token scoped to actions: write on OvertureMaps/docs, which no existing app provides (overture-release-publisher, #637, is contents: write on this repo only). Filed #689 to provision a new overture-docs-publisher app and its two secrets; the workflow references that issue and won't function until it's done. Also notes the new trigger in docs/versioning.md's release flow diagram. Refs #679, #689 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall --- .github/workflows/docs-publish.yml | 83 ++++++++++++++++++++++++++++++ docs/versioning.md | 4 ++ 2 files changed, 87 insertions(+) create mode 100644 .github/workflows/docs-publish.yml diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml new file mode 100644 index 000000000..4f71d7cac --- /dev/null +++ b/.github/workflows/docs-publish.yml @@ -0,0 +1,83 @@ +name: Trigger docs publication + +# Fires when the umbrella overture-schema package's GitHub Release is +# published (see release-trigger.yaml and docs/versioning.md for the tag +# scheme) and dispatches a production rebuild of OvertureMaps/docs so its +# generated schema reference (docs/schema/reference/**, built via the +# OvertureMaps/workflows generate-schema-docs action) stays in sync with +# schema releases. +# +# Only the overture-schema release is dispatched: it's the sole release +# marked "Latest" and the only one carrying the vanity `v` tag docs +# consumes as its recognized public schema version (see docs/versioning.md). +# Per-theme package releases (overture-schema-theme-*) don't independently +# version the docs site's reference and are skipped. +# +# Requires a GitHub App installed on OvertureMaps/docs with `actions: write` +# (schema's own overture-release-publisher app is schema-repo-only with +# contents: write, see #637, and can't dispatch workflows on another repo). +# Provisioning that app and its secrets is a manual prerequisite tracked in +# #689. + +on: + release: + types: [published] + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }} + cancel-in-progress: false + +jobs: + dispatch-docs-build: + name: Dispatch docs production build + if: startsWith(github.event.release.tag_name, 'overture-schema-v') + runs-on: ubuntu-slim + permissions: + contents: read # Read the vanity tag to resolve schema-ref + steps: + - name: Resolve schema-ref + id: resolve-ref + env: + GH_TOKEN: ${{ github.token }} + TAG_NAME: ${{ github.event.release.tag_name }} + run: | + set -euo pipefail + + # The umbrella release always ships alongside a bare vanity tag + # (v, see .github/actions/create-package-release and + # docs/versioning.md); that's the recognized public schema version, + # so prefer it over the package-prefixed release tag. + version="${TAG_NAME#overture-schema-v}" + vanity_tag="v${version}" + + if gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${vanity_tag}" >/dev/null 2>&1; then + echo "schema-ref=${vanity_tag}" >> "$GITHUB_OUTPUT" + else + echo "::warning::Vanity tag ${vanity_tag} not found for ${TAG_NAME}; falling back to the release tag." + echo "schema-ref=${TAG_NAME}" >> "$GITHUB_OUTPUT" + fi + + # Manual prerequisite: the overture-docs-publisher app, its + # installation on OvertureMaps/docs, and these two secrets are tracked + # in #689 and don't exist yet. + - name: Generate docs publisher app token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ secrets.DOCS_PUBLISHER_APP_ID }} # zizmor: ignore[secrets-outside-env] + private-key: ${{ secrets.DOCS_PUBLISHER_APP_PEM }} # zizmor: ignore[secrets-outside-env] + owner: OvertureMaps + repositories: docs + permission-actions: write # Required to dispatch a workflow run on OvertureMaps/docs + + - name: Trigger docs production build + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} + SCHEMA_REF: ${{ steps.resolve-ref.outputs.schema-ref }} + run: | + gh workflow run production_deploy_documentation.yml \ + --repo OvertureMaps/docs \ + --field schema-ref="${SCHEMA_REF}" diff --git a/docs/versioning.md b/docs/versioning.md index 31ae9971c..2e235405b 100644 --- a/docs/versioning.md +++ b/docs/versioning.md @@ -174,11 +174,15 @@ changes that package, whether or not it bumps the version. `CHANGELOG.md`. 3. Publishing the release starts the PyPI publish, gated by a maintainer approval. +4. Publishing the `overture-schema` release also fires `docs-publish.yaml`, + which dispatches a production rebuild of the docs site so its generated + schema reference stays in sync (see #679). ```mermaid flowchart LR A[bump + towncrier build
merged to main] --> B[release-trigger:
GitHub Release per package] B --> C[PyPI publish
maintainer approval] --> D[public PyPI] + B --> G[docs-publish:
overture-schema release only] --> H[docs site rebuild] E[no-bump merge] --> F[.postN internal build
CodeArtifact only] ``` From bacd3938b3eb24bc9744a1ffdb1954f842fad5cf Mon Sep 17 00:00:00 2001 From: John McCall Date: Mon, 24 Aug 2026 12:50:43 -0400 Subject: [PATCH 02/10] Reuse overture-releaser app instead of provisioning a new one Per direction: extend the existing overture-releaser app (already used by release-trigger.yaml) with actions: write and install it on OvertureMaps/docs, rather than filing for a brand-new app. docs-publish.yml now fetches the same AWS Secrets Manager PEM via the same gha-releaser-secrets-reader OIDC role and client ID release-trigger.yaml uses, just scoping the minted token to permission-actions instead of permission-contents. Refs #679, #689 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall --- .github/workflows/docs-publish.yml | 40 ++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 10 deletions(-) diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml index 4f71d7cac..21b9fc444 100644 --- a/.github/workflows/docs-publish.yml +++ b/.github/workflows/docs-publish.yml @@ -13,11 +13,17 @@ name: Trigger docs publication # Per-theme package releases (overture-schema-theme-*) don't independently # version the docs site's reference and are skipped. # -# Requires a GitHub App installed on OvertureMaps/docs with `actions: write` -# (schema's own overture-release-publisher app is schema-repo-only with -# contents: write, see #637, and can't dispatch workflows on another repo). -# Provisioning that app and its secrets is a manual prerequisite tracked in -# #689. +# Requires the overture-releaser app (release-trigger.yaml's app, #637) to +# also be installed on OvertureMaps/docs with an added `actions: write` +# permission -- it's schema-repo-only with `contents: write` today, and +# can't dispatch workflows on another repo. Extending it (deliberately +# bending omf-github-terraform's "one app per concern" convention rather +# than provisioning a new app) is a manual prerequisite tracked in #689. +# +# Reuses release-trigger.yaml's exact PEM fetch: same AWS Secrets Manager +# entry (omf-github-terraform/releaser/pem), same gha-releaser-secrets-reader +# OIDC role, same client ID, just scoped to permission-actions instead of +# permission-contents. on: release: @@ -37,6 +43,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read # Read the vanity tag to resolve schema-ref + id-token: write # Required for OIDC authentication to AWS steps: - name: Resolve schema-ref id: resolve-ref @@ -60,15 +67,28 @@ jobs: echo "schema-ref=${TAG_NAME}" >> "$GITHUB_OUTPUT" fi - # Manual prerequisite: the overture-docs-publisher app, its - # installation on OvertureMaps/docs, and these two secrets are tracked - # in #689 and don't exist yet. + # Narrow OIDC role (omf-github-terraform's oidc-aws.tf) that can only + # read the releaser app's PEM secret. + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 + with: + aws-region: us-west-2 + role-to-assume: arn:aws:iam::816069134238:role/gha-releaser-secrets-reader + role-session-name: GitHubActions_${{github.job}}_${{github.run_id}} + + # Exports the PEM as env.RELEASE_PUBLISHER_APP_PEM, masked (incl. multi-line). + - name: Fetch releaser PEM from Secrets Manager + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 + with: + secret-ids: | + RELEASE_PUBLISHER_APP_PEM, omf-github-terraform/releaser/pem + - name: Generate docs publisher app token id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - client-id: ${{ secrets.DOCS_PUBLISHER_APP_ID }} # zizmor: ignore[secrets-outside-env] - private-key: ${{ secrets.DOCS_PUBLISHER_APP_PEM }} # zizmor: ignore[secrets-outside-env] + client-id: Iv23lijru2e660v1zJQO # overture-releaser app ID, not sensitive + private-key: ${{ env.RELEASE_PUBLISHER_APP_PEM }} # zizmor: ignore[secrets-outside-env] owner: OvertureMaps repositories: docs permission-actions: write # Required to dispatch a workflow run on OvertureMaps/docs From d3f952df7e398ff3ce03931c48813dbef5576bf9 Mon Sep 17 00:00:00 2001 From: John McCall Date: Mon, 24 Aug 2026 12:58:37 -0400 Subject: [PATCH 03/10] Switch trigger to push:tags v* instead of release:published release: doesn't support a tag-pattern filter (only push/create do), so filtering required a job-level if condition plus an API lookup to resolve the vanity tag as schema-ref. Triggering off push: tags: ['v*'] instead makes the tag glob itself the filter (only overture-schema's release creates a bare v* tag) and github.ref_name is the vanity tag directly, no lookup step needed. Tradeoff, documented in the workflow: if create-package-release ever skips the vanity tag because it already exists, no push fires and the docs rebuild silently doesn't dispatch for that release. Accepted per explicit direction in favor of the simpler workflow. Refs #679, #689 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall --- .github/workflows/docs-publish.yml | 57 ++++++++++-------------------- 1 file changed, 19 insertions(+), 38 deletions(-) diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml index 21b9fc444..cc6f5a1bf 100644 --- a/.github/workflows/docs-publish.yml +++ b/.github/workflows/docs-publish.yml @@ -1,17 +1,22 @@ name: Trigger docs publication -# Fires when the umbrella overture-schema package's GitHub Release is -# published (see release-trigger.yaml and docs/versioning.md for the tag -# scheme) and dispatches a production rebuild of OvertureMaps/docs so its -# generated schema reference (docs/schema/reference/**, built via the -# OvertureMaps/workflows generate-schema-docs action) stays in sync with -# schema releases. +# Fires on the bare `v` vanity tag that .github/actions/create- +# package-release creates only for the umbrella overture-schema package's +# release (see docs/versioning.md's tag scheme), and dispatches a production +# rebuild of OvertureMaps/docs so its generated schema reference +# (docs/schema/reference/**, built via the OvertureMaps/workflows +# generate-schema-docs action) stays in sync with schema releases. # -# Only the overture-schema release is dispatched: it's the sole release -# marked "Latest" and the only one carrying the vanity `v` tag docs -# consumes as its recognized public schema version (see docs/versioning.md). -# Per-theme package releases (overture-schema-theme-*) don't independently -# version the docs site's reference and are skipped. +# The `v*` tag glob is the filter: no other package's release creates a bare +# `v*` tag, so this only ever fires for overture-schema. github.ref_name is +# the vanity tag itself, used directly as schema-ref with no lookup needed. +# +# Caveat: create-package-release skips (warns, doesn't fail) the vanity tag +# step if that tag already exists, e.g. a re-cut release reusing a version. +# No new tag means no push event, so that rare case silently doesn't +# dispatch a docs rebuild; a maintainer can always re-run this workflow by +# hand (workflow_dispatch isn't wired up here, but `gh workflow run +# docs-publish.yml --ref v` works against the existing tag). # # Requires the overture-releaser app (release-trigger.yaml's app, #637) to # also be installed on OvertureMaps/docs with an added `actions: write` @@ -26,8 +31,8 @@ name: Trigger docs publication # permission-contents. on: - release: - types: [published] + push: + tags: ["v*"] permissions: contents: read @@ -39,34 +44,10 @@ concurrency: jobs: dispatch-docs-build: name: Dispatch docs production build - if: startsWith(github.event.release.tag_name, 'overture-schema-v') runs-on: ubuntu-slim permissions: - contents: read # Read the vanity tag to resolve schema-ref id-token: write # Required for OIDC authentication to AWS steps: - - name: Resolve schema-ref - id: resolve-ref - env: - GH_TOKEN: ${{ github.token }} - TAG_NAME: ${{ github.event.release.tag_name }} - run: | - set -euo pipefail - - # The umbrella release always ships alongside a bare vanity tag - # (v, see .github/actions/create-package-release and - # docs/versioning.md); that's the recognized public schema version, - # so prefer it over the package-prefixed release tag. - version="${TAG_NAME#overture-schema-v}" - vanity_tag="v${version}" - - if gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${vanity_tag}" >/dev/null 2>&1; then - echo "schema-ref=${vanity_tag}" >> "$GITHUB_OUTPUT" - else - echo "::warning::Vanity tag ${vanity_tag} not found for ${TAG_NAME}; falling back to the release tag." - echo "schema-ref=${TAG_NAME}" >> "$GITHUB_OUTPUT" - fi - # Narrow OIDC role (omf-github-terraform's oidc-aws.tf) that can only # read the releaser app's PEM secret. - name: Configure AWS credentials @@ -96,7 +77,7 @@ jobs: - name: Trigger docs production build env: GH_TOKEN: ${{ steps.app-token.outputs.token }} - SCHEMA_REF: ${{ steps.resolve-ref.outputs.schema-ref }} + SCHEMA_REF: ${{ github.ref_name }} run: | gh workflow run production_deploy_documentation.yml \ --repo OvertureMaps/docs \ From bd6a71438d98f99768ba34ed98bacafdb16700bc Mon Sep 17 00:00:00 2001 From: John McCall Date: Mon, 24 Aug 2026 13:02:47 -0400 Subject: [PATCH 04/10] Move docs-publish.yml's in-depth comments into versioning.md The workflow's header comment covered the trigger mechanics, the vanity-tag edge case, and the overture-releaser reuse rationale in one long block. Trimmed it to a few lines pointing at docs/versioning.md's Cut a release section, which now spells all of that out where a reader is more likely to look for it alongside the rest of the release flow. Refs #679, #689 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall --- .github/workflows/docs-publish.yml | 33 ++++-------------------------- docs/versioning.md | 18 ++++++++++++---- 2 files changed, 18 insertions(+), 33 deletions(-) diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml index cc6f5a1bf..fc41ffae1 100644 --- a/.github/workflows/docs-publish.yml +++ b/.github/workflows/docs-publish.yml @@ -1,34 +1,9 @@ name: Trigger docs publication -# Fires on the bare `v` vanity tag that .github/actions/create- -# package-release creates only for the umbrella overture-schema package's -# release (see docs/versioning.md's tag scheme), and dispatches a production -# rebuild of OvertureMaps/docs so its generated schema reference -# (docs/schema/reference/**, built via the OvertureMaps/workflows -# generate-schema-docs action) stays in sync with schema releases. -# -# The `v*` tag glob is the filter: no other package's release creates a bare -# `v*` tag, so this only ever fires for overture-schema. github.ref_name is -# the vanity tag itself, used directly as schema-ref with no lookup needed. -# -# Caveat: create-package-release skips (warns, doesn't fail) the vanity tag -# step if that tag already exists, e.g. a re-cut release reusing a version. -# No new tag means no push event, so that rare case silently doesn't -# dispatch a docs rebuild; a maintainer can always re-run this workflow by -# hand (workflow_dispatch isn't wired up here, but `gh workflow run -# docs-publish.yml --ref v` works against the existing tag). -# -# Requires the overture-releaser app (release-trigger.yaml's app, #637) to -# also be installed on OvertureMaps/docs with an added `actions: write` -# permission -- it's schema-repo-only with `contents: write` today, and -# can't dispatch workflows on another repo. Extending it (deliberately -# bending omf-github-terraform's "one app per concern" convention rather -# than provisioning a new app) is a manual prerequisite tracked in #689. -# -# Reuses release-trigger.yaml's exact PEM fetch: same AWS Secrets Manager -# entry (omf-github-terraform/releaser/pem), same gha-releaser-secrets-reader -# OIDC role, same client ID, just scoped to permission-actions instead of -# permission-contents. +# Fires on overture-schema's vanity tag push and dispatches a production +# rebuild of OvertureMaps/docs so its generated schema reference stays in +# sync. See "Cut a release" in docs/versioning.md for the trigger mechanics +# and edge cases, and #637/#689 for the overture-releaser app this reuses. on: push: diff --git a/docs/versioning.md b/docs/versioning.md index 2e235405b..88ab4011b 100644 --- a/docs/versioning.md +++ b/docs/versioning.md @@ -174,15 +174,25 @@ changes that package, whether or not it bumps the version. `CHANGELOG.md`. 3. Publishing the release starts the PyPI publish, gated by a maintainer approval. -4. Publishing the `overture-schema` release also fires `docs-publish.yaml`, - which dispatches a production rebuild of the docs site so its generated - schema reference stays in sync (see #679). +4. Publishing the `overture-schema` release also pushes its vanity tag (see + [Tag scheme](#tag-scheme)), which `docs-publish.yaml` reacts to to + dispatch a production docs rebuild so the generated schema reference + stays in sync (see #679). The tag push is the trigger and the filter: + no other package's release creates a bare `v*` tag, and the tag itself is + passed straight through as the docs build's `schema-ref`, no lookup + needed. One edge case: if the vanity tag step is ever skipped because + that tag already exists (a re-cut release reusing a version), no tag push + fires and the docs rebuild silently doesn't dispatch; re-run + `docs-publish.yaml` by hand against the existing tag in that case. + Dispatching cross-repo reuses the `overture-releaser` app (#637) with an + added `Actions: write` permission and an install on the docs repo (#689), + rather than a new app. ```mermaid flowchart LR A[bump + towncrier build
merged to main] --> B[release-trigger:
GitHub Release per package] B --> C[PyPI publish
maintainer approval] --> D[public PyPI] - B --> G[docs-publish:
overture-schema release only] --> H[docs site rebuild] + B --> G[docs-publish:
overture-schema vanity tag] --> H[docs site rebuild] E[no-bump merge] --> F[.postN internal build
CodeArtifact only] ``` From 468011d8c8a0bdf61e8b8ee247350cda1f1200e5 Mon Sep 17 00:00:00 2001 From: John McCall Date: Mon, 24 Aug 2026 13:03:37 -0400 Subject: [PATCH 05/10] Trim docs-publish.yml header comment further Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall --- .github/workflows/docs-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml index fc41ffae1..d23d1846b 100644 --- a/.github/workflows/docs-publish.yml +++ b/.github/workflows/docs-publish.yml @@ -3,7 +3,7 @@ name: Trigger docs publication # Fires on overture-schema's vanity tag push and dispatches a production # rebuild of OvertureMaps/docs so its generated schema reference stays in # sync. See "Cut a release" in docs/versioning.md for the trigger mechanics -# and edge cases, and #637/#689 for the overture-releaser app this reuses. +# and edge cases. on: push: From 197596d29f96c501f551694217bc42b878b8828f Mon Sep 17 00:00:00 2001 From: John McCall Date: Mon, 24 Aug 2026 13:03:59 -0400 Subject: [PATCH 06/10] Note v* tag as a proxy for a new schema version Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall --- .github/workflows/docs-publish.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml index d23d1846b..9383d6fca 100644 --- a/.github/workflows/docs-publish.yml +++ b/.github/workflows/docs-publish.yml @@ -7,6 +7,7 @@ name: Trigger docs publication on: push: + # Proxy for "a new overture-schema version was released." tags: ["v*"] permissions: From fec60fad3ed3ef28372848924c00f666df46426a Mon Sep 17 00:00:00 2001 From: John McCall Date: Mon, 24 Aug 2026 13:04:17 -0400 Subject: [PATCH 07/10] Trim OIDC role comment Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall --- .github/workflows/docs-publish.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml index 9383d6fca..7770f0c4d 100644 --- a/.github/workflows/docs-publish.yml +++ b/.github/workflows/docs-publish.yml @@ -24,8 +24,7 @@ jobs: permissions: id-token: write # Required for OIDC authentication to AWS steps: - # Narrow OIDC role (omf-github-terraform's oidc-aws.tf) that can only - # read the releaser app's PEM secret. + # Narrow OIDC role that can only read the releaser app's PEM secret. - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: From a046997357a51e10c5fdedba5f3aa4577e72df98 Mon Sep 17 00:00:00 2001 From: John McCall Date: Mon, 24 Aug 2026 13:33:02 -0400 Subject: [PATCH 08/10] Trim versioning.md docs-publish details (remove edge case and app-provisioning mechanics) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall --- docs/versioning.md | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/docs/versioning.md b/docs/versioning.md index 88ab4011b..01500b236 100644 --- a/docs/versioning.md +++ b/docs/versioning.md @@ -180,13 +180,8 @@ changes that package, whether or not it bumps the version. stays in sync (see #679). The tag push is the trigger and the filter: no other package's release creates a bare `v*` tag, and the tag itself is passed straight through as the docs build's `schema-ref`, no lookup - needed. One edge case: if the vanity tag step is ever skipped because - that tag already exists (a re-cut release reusing a version), no tag push - fires and the docs rebuild silently doesn't dispatch; re-run - `docs-publish.yaml` by hand against the existing tag in that case. - Dispatching cross-repo reuses the `overture-releaser` app (#637) with an - added `Actions: write` permission and an install on the docs repo (#689), - rather than a new app. + needed. Dispatching cross-repo uses the `overture-releaser` app (#637, + #689). ```mermaid flowchart LR From b4019f9599f864b38cecf7e7bb2d2c4d0c34369a Mon Sep 17 00:00:00 2001 From: John McCall Date: Mon, 24 Aug 2026 13:42:02 -0400 Subject: [PATCH 09/10] Fix docs-publish.yml filename typo and duplicated word in versioning.md Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall --- docs/versioning.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/versioning.md b/docs/versioning.md index 01500b236..6ed3d7116 100644 --- a/docs/versioning.md +++ b/docs/versioning.md @@ -175,7 +175,7 @@ changes that package, whether or not it bumps the version. 3. Publishing the release starts the PyPI publish, gated by a maintainer approval. 4. Publishing the `overture-schema` release also pushes its vanity tag (see - [Tag scheme](#tag-scheme)), which `docs-publish.yaml` reacts to to + [Tag scheme](#tag-scheme)), which `docs-publish.yml` reacts to dispatch a production docs rebuild so the generated schema reference stays in sync (see #679). The tag push is the trigger and the filter: no other package's release creates a bare `v*` tag, and the tag itself is From 770511c151ec9cb807ea18046bd96b79cb6cf907 Mon Sep 17 00:00:00 2001 From: John McCall Date: Mon, 24 Aug 2026 13:45:15 -0400 Subject: [PATCH 10/10] Clarify client-id comment says client ID, not app ID Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall --- .github/workflows/docs-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml index 7770f0c4d..8e3c791ae 100644 --- a/.github/workflows/docs-publish.yml +++ b/.github/workflows/docs-publish.yml @@ -43,7 +43,7 @@ jobs: id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - client-id: Iv23lijru2e660v1zJQO # overture-releaser app ID, not sensitive + client-id: Iv23lijru2e660v1zJQO # overture-releaser app client ID, not sensitive private-key: ${{ env.RELEASE_PUBLISHER_APP_PEM }} # zizmor: ignore[secrets-outside-env] owner: OvertureMaps repositories: docs