ci: update docs publishing myst switcher release version

.github/workflows/ci.yml

@@ -45,7 +45,7 @@ jobs:
       packages: write
 
   docs: # Call the docs building workflow directly
-    uses: DiamondLightSource/myst-version-switcher-plugin/.github/workflows/docs.yml@v0.24
+    uses: DiamondLightSource/myst-version-switcher-plugin/.github/workflows/docs.yml@v0.27.0
     with:
       # Whatever turns your sources into docs/_build/html at $BASE_URL. uv and Node
       # are preinstalled, so: make docs · tox -e docs · npm ci && npm run docs
@@ -65,20 +65,6 @@ jobs:
   release:
     needs: [dist, test, docs]
     if: github.ref_type == 'tag' # tag pushes only
-    uses: DiamondLightSource/myst-version-switcher-plugin/.github/workflows/release.yml@v0.24
+    uses: DiamondLightSource/myst-version-switcher-plugin/.github/workflows/release.yml@v0.27.0
     permissions:
       contents: write # create the Release + attach assets
-
-  publish:
-    needs: [docs]
-    # don't publish a pages site in the fork's org
-    if: github.repository == 'DiamondLightSource/blueapi' && github.ref_type == 'tag' # publish only on tags
-    uses: ./.github/workflows/publish-dispatch.yml # your workflow (below)
-    with:
-      version-name: ${{ needs.docs.outputs.version-name }}
-    permissions:
-      contents: read
-      actions: write
-      pages: write
-      id-token: write
-      statuses: write

.github/workflows/publish.yml

@@ -0,0 +1,39 @@
+name: Publish
+
+on:
+  # matches ci.yml's `name:`, NOT its filename
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+
+  # fork-PR previews and manual re-deploys
+  workflow_dispatch:
+    inputs:
+      pr:
+        description: "Fork PR to approve + preview (empty = re-deploy)"
+        required: false
+        default: ""
+
+jobs:
+  publish:
+    # Both guards fail OPEN — copy them verbatim.
+    #   conclusion == 'success' : workflow_run fires on failures too
+    #   head_repository == this repo : workflow_run holds a WRITE token even when a
+    #     fork's PR triggered it (the pwn-request shape)
+    # The repository check keeps forks of blueapi from publishing to their own Pages.
+    if: >-
+      github.repository == 'DiamondLightSource/blueapi' &&
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.head_repository.full_name == github.repository))
+    uses: DiamondLightSource/myst-version-switcher-plugin/.github/workflows/publish-gh-pages.yml@v0.27.0
+    with:
+      pr: ${{ inputs.pr }}
+      max-releases: "30"
+      max-prs: "20"
+    permissions:
+      contents: read
+      actions: read      # gather cross-run docs artifacts
+      pages: write
+      id-token: write
+      statuses: write    # record the fork-preview approval / preview link