fix: trigger docs deploy via workflow_call from docs.yml (#443)

workflow_run does not fire for tag-triggered workflows, and GITHUB_TOKEN
pushes do not trigger other workflows. Use workflow_call instead:
docs.yml explicitly calls docs-deploy.yml after publish jobs complete.

The deploy job only runs when at least one publish job succeeded,
so PR builds (where all publish jobs are skipped) do not trigger a deploy.

Author: marc0olo

.github/workflows/docs-deploy.yml

@@ -1,8 +1,7 @@
 name: Deploy Docs to Internet Computer
 
 on:
-  push:
-    branches: [docs-deployment]
+  workflow_call:
   workflow_dispatch:
 
 concurrency:

.github/workflows/docs.yml

@@ -212,3 +212,11 @@ jobs:
           publish_dir: ./docs-site/dist
           publish_branch: docs-deployment
           destination_dir: ${{ env.DOCS_VERSION }}
+
+  # Deploy docs-deployment branch to IC asset canister.
+  # Runs when at least one publish job succeeded (skipped on PR builds).
+  deploy-to-ic:
+    needs: [publish-root-files, publish-main-docs, publish-versioned-docs]
+    if: github.event_name != 'pull_request'
+    uses: ./.github/workflows/docs-deploy.yml
+    secrets: inherit

docs-site/README.md

@@ -103,7 +103,7 @@ The site is hosted on an IC asset canister and served at `https://cli.internetco
 ### How it works
 
 1. **`.github/workflows/docs.yml`** builds documentation and pushes built files to the `docs-deployment` branch (one directory per version: `0.1/`, `0.2/`, `main/`, etc.)
-2. **`.github/workflows/docs-deploy.yml`** triggers on pushes to `docs-deployment` and deploys the entire branch to the IC asset canister
+2. **`.github/workflows/docs-deploy.yml`** is called by `docs.yml` after publish jobs complete and deploys the entire `docs-deployment` branch to the IC asset canister
 
 ### Triggers
 

docs/VERSIONED_DOCS.md

@@ -45,7 +45,7 @@ All built assets live on the `docs-deployment` branch:
 
 **`.github/workflows/docs-deploy.yml`** — deploys `docs-deployment` to the IC:
 
-- Triggers automatically whenever `docs.yml` pushes to `docs-deployment`
+- Called directly by `docs.yml` after publish jobs complete (avoids `GITHUB_TOKEN` cross-workflow trigger limitations)
 - Runs `icp deploy -e ic docs` using the `DFX_IDENTITY_DESIGN_TEAM` secret
 - Requires the **IC mainnet** GitHub environment