docs and publish protection

Author: clavery

.github/workflows/deploy-docs.yml

@@ -1,8 +1,6 @@
 name: Deploy Documentation
 
 on:
-  push:
-    branches: [main]
   workflow_dispatch:
 
 permissions:
@@ -52,14 +50,9 @@ jobs:
       - name: Get latest release tag
         id: release
         run: |
-          # Find the most recent package tag and docs tag by creation date.
-          # This is safe because only @latest publishes and doc-only releases
-          # trigger this workflow — maintenance patches on older minors are
-          # excluded by the publish workflow gate.
           PKG_TAG=$(git tag --list '@salesforce/*' --sort=-creatordate | head -n1)
           DOCS_TAG=$(git tag --list 'docs@*' --sort=-creatordate | head -n1)
 
-          # Pick whichever tag was created more recently
           LATEST_TAG=""
           if [[ -n "$PKG_TAG" && -n "$DOCS_TAG" ]]; then
             LATEST_TAG=$(git tag --list '@salesforce/*' --list 'docs@*' --sort=-creatordate | head -n1)
@@ -69,58 +62,38 @@ jobs:
             LATEST_TAG="$DOCS_TAG"
           fi
 
-          echo "Latest package tag: ${PKG_TAG:-<none>}"
-          echo "Latest docs tag: ${DOCS_TAG:-<none>}"
-          echo "Building stable docs from: ${LATEST_TAG:-<none>}"
-
+          echo "Building docs from: ${LATEST_TAG:-<none>}"
           echo "tag=$LATEST_TAG" >> $GITHUB_OUTPUT
-          echo "exists=$([[ -n $LATEST_TAG ]] && echo true || echo false)" >> $GITHUB_OUTPUT
-
-      - name: Build dev documentation
-        run: |
-          IS_DEV_BUILD=true pnpm run docs:build
-          mv docs/.vitepress/dist docs/.vitepress/dist-dev
 
-      - name: Build stable documentation from release tag
-        if: steps.release.outputs.exists == 'true'
+      - name: Build documentation from release tag
         run: |
-          # Save docs build files from main (config has version dropdown/dynamic
-          # base path, and package.json/lockfile have its dependencies)
+          # Save config and deps from main (has version dropdown and latest dependencies)
           cp docs/.vitepress/config.mts /tmp/config.mts
           cp docs/package.json /tmp/docs-package.json
           cp pnpm-lock.yaml /tmp/pnpm-lock.yaml
 
           # Remove S3-extracted uxstudio files before checkout to avoid conflicts
-          # (older tags still have these files tracked in git)
           rm -rf docs/public/uxstudio
 
           # Checkout release tag
           git checkout ${{ steps.release.outputs.tag }}
 
-          # Ensure UX Studio artifacts are present (older tags have them in git,
-          # future tags won't — always extract from S3 to be safe)
+          # Restore UX Studio artifacts
           rm -rf docs/public/uxstudio
           mkdir -p docs/public/uxstudio
           tar -xzf /tmp/uxstudio-4.5.tar.gz -C docs/public/uxstudio
           tar -xzf /tmp/uxstudio-4.6.tar.gz -C docs/public/uxstudio
 
-          # Restore docs build files from main so dependencies match the config
+          # Restore config and deps from main
           cp /tmp/config.mts docs/.vitepress/config.mts
           cp /tmp/docs-package.json docs/package.json
           cp /tmp/pnpm-lock.yaml pnpm-lock.yaml
 
-          # Build at release tag with main's config (no IS_DEV_BUILD = stable at root)
+          # Build docs
           pnpm install --frozen-lockfile
           pnpm -r run build
           pnpm run docs:build
 
-          # Combine: stable at root, dev in /dev/
-          mv docs/.vitepress/dist-dev docs/.vitepress/dist/dev
-
-      - name: Use dev as root when no release exists
-        if: steps.release.outputs.exists != 'true'
-        run: mv docs/.vitepress/dist-dev docs/.vitepress/dist
-
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v4
         with:

.github/workflows/publish.yml

@@ -226,24 +226,32 @@ jobs:
 
       - name: Publish SDK to npm
         if: steps.release-type.outputs.type == 'nightly' || steps.packages.outputs.publish_sdk == 'true'
+        id: publish-sdk
+        continue-on-error: true
         run: >-
           pnpm --filter @salesforce/b2c-tooling-sdk publish --provenance --no-git-checks
           --tag ${{ steps.release-type.outputs.type == 'nightly' && 'nightly' || steps.packages.outputs.tag_sdk }}
 
       - name: Publish CLI to npm
         if: steps.release-type.outputs.type == 'nightly' || steps.packages.outputs.publish_cli == 'true'
+        id: publish-cli
+        continue-on-error: true
         run: >-
           pnpm --filter @salesforce/b2c-cli publish --provenance --no-git-checks
           --tag ${{ steps.release-type.outputs.type == 'nightly' && 'nightly' || steps.packages.outputs.tag_cli }}
 
       - name: Publish MCP to npm
         if: steps.release-type.outputs.type == 'nightly' || steps.packages.outputs.publish_mcp == 'true'
+        id: publish-mcp
+        continue-on-error: true
         run: >-
           pnpm --filter @salesforce/b2c-dx-mcp publish --provenance --no-git-checks
           --tag ${{ steps.release-type.outputs.type == 'nightly' && 'nightly' || steps.packages.outputs.tag_mcp }}
 
       - name: Publish MRT Utilities to npm
         if: steps.release-type.outputs.type == 'nightly' || steps.packages.outputs.publish_mrt == 'true'
+        id: publish-mrt
+        continue-on-error: true
         run: >-
           pnpm --filter @salesforce/mrt-utilities publish --provenance --no-git-checks
           --tag ${{ steps.release-type.outputs.type == 'nightly' && 'nightly' || steps.packages.outputs.tag_mrt }}
@@ -536,3 +544,13 @@ jobs:
           fi
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Fail if any publish failed
+        if: always() && (steps.publish-sdk.outcome == 'failure' || steps.publish-cli.outcome == 'failure' || steps.publish-mcp.outcome == 'failure' || steps.publish-mrt.outcome == 'failure')
+        run: |
+          echo "::error::One or more npm publishes failed:"
+          [[ "${{ steps.publish-sdk.outcome }}" == "failure" ]] && echo "  - SDK"
+          [[ "${{ steps.publish-cli.outcome }}" == "failure" ]] && echo "  - CLI"
+          [[ "${{ steps.publish-mcp.outcome }}" == "failure" ]] && echo "  - MCP"
+          [[ "${{ steps.publish-mrt.outcome }}" == "failure" ]] && echo "  - MRT"
+          exit 1