updated workflows

.github/workflows/docs-deploy.yml

@@ -1,17 +1,9 @@
 name: Deploy PalaceToolkit Docs
 
 on:
-  workflow_dispatch:
-    inputs:
-      stage:
-        description: "SST stage"
-        required: false
-        default: "production"
-        type: choice
-        options:
-          - production
-          - staging
-  push:
+  pull_request_target:
+    types:
+      - closed
     branches:
       - main
     paths:
@@ -27,16 +19,22 @@ permissions:
   contents: read
 
 concurrency:
-  group: epsilonforge-palace-docs-${{ github.event.inputs.stage || 'production' }}
+  group: epsilonforge-palace-docs-production
   cancel-in-progress: false
 
 env:
-  AWS_ACCOUNT_ID: "527097962874"
+  # Override via repository variable EPSILON_FORGE_AWS_ACCOUNT_ID when needed.
+  AWS_ACCOUNT_ID: ${{ vars['EPSILON_FORGE_AWS_ACCOUNT_ID'] || '527097962874' }}
   AWS_REGION: us-east-2
-  SST_STAGE: ${{ github.event.inputs.stage || 'production' }}
+  SST_STAGE: production
 
 jobs:
   deploy-docs:
+    if: github.event.pull_request.merged == true
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-24.04
 
     steps:

.github/workflows/docs-doctest.yml

@@ -0,0 +1,38 @@
+name: Docs Doctest
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docs-doctest-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  docs-doctest:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install docs test dependencies
+        run: |
+          set -euo pipefail
+          python -m pip install --upgrade pip
+          python -m pip install mkdocs mkdocs-material mkdocs-jupyter pytest
+
+      - name: Run docs build doctest
+        run: |
+          set -euo pipefail
+          python -m pytest -q tests/test_docs_build.py

README.md

@@ -212,6 +212,20 @@ distribution ID from AWS SSM Parameter Store.
 
 - Role name pattern: `epsilon-forge-palace-toolkit-docs-deploy-<stage>`
 - SSM parameter pattern: `/epsilon-forge/<stage>/router-distribution-id`
+- AWS account has an IAM OIDC provider for `https://token.actions.githubusercontent.com`
+
+For account `527097962874`, the provider ARN is expected to be:
+
+```text
+arn:aws:iam::527097962874:oidc-provider/token.actions.githubusercontent.com
+```
+
+The deploy role trust policy must allow `sts:AssumeRoleWithWebIdentity` for this
+repository. For pushes to `main`, the subject should match:
+
+```text
+repo:EpsilonForge/PalaceToolkit:ref:refs/heads/main
+```
 
 Both are created by the private infrastructure repo stack outputs.
 ### Other useful recipes