feat!: publish on workflow_run, deleting the trampoline, shim and injection

.devcontainer/devcontainer.json

@@ -24,8 +24,7 @@
 		// Allow the container to access the host X11 display and EPICS CA
 		"--net=host",
 		// Make sure SELinux does not disable with access to host filesystems like tmp
-		"--security-opt=label=disable",
-		"--device=/dev/net/tun"
+		"--security-opt=label=disable"
 	],
 	"mounts": [
 		// Mount in the user terminal config folder so it can be edited

.github/workflows/ci.yml

@@ -1,15 +1,14 @@
 name: CI
 
-# Verify + build, then publish on INTERNAL events. Runs on every PR (including
-# forks), pushes to main, and tags — lint, test, build the docs, and on tags
-# publish the release assets. It uploads each build's `docs` artifact.
+# Verify + build. Runs on every PR (including forks), pushes to main, and tags — lint,
+# test, build the docs, and on tags publish the release assets. It uploads each build's
+# `docs` artifact.
 #
-# Publishing is nested here (the `publish` job → publish-dispatch.yml shim → publish.yml)
-# so its status is visible on the PR / commit. A single `publish` job covers every event;
-# publish.yml branches internally into deploy (internal PR / main push), tag re-dispatch
-# (a same-SHA tag deploy would be silently dropped by Pages unless dispatched), or a
-# fork-PR warning (forks build with a read-only token and never deploy). See the
-# architecture explanation in docs/.
+# It does NOT publish the site. publish.yml picks this run up on `workflow_run` once it
+# completes and deploys from there, so the site's reconstruction cost stays out of every
+# PR's critical path and a Pages failure never shows as a red check against an author who
+# cannot act on it. That also means this workflow needs no elevated permissions, and its
+# `name:` below is load-bearing — publish.yml matches on it.
 on:
   pull_request:
   push:
@@ -36,30 +35,3 @@ jobs:
     uses: ./.github/workflows/release.yml
     permissions:
       contents: write    # create the GitHub Release + attach assets
-
-  # One publish job for every event — publish.yml (reached via the publish-dispatch.yml
-  # shim) owns the branching (deploy inline / tag re-dispatch / fork-PR warn), so there's
-  # no separate tag or fork job and no ref/fork guards here. It runs for fork PRs too,
-  # but only to surface the opt-in hint: publish.yml's `deploy` job excludes forks and a
-  # fork PR's token is read-only, so untrusted code never reaches a write token.
-  # `actions: write` lets the re-dispatch job re-fire the shim; `version-name` is the
-  # in-run build for the inline path (ignored by the re-dispatch/warn branches).
-  # TEMPORARILY DISABLED — _probe-workflow-run.yml's experiment needs the workflow_run path
-  # to be the ONLY deploy path, so the experiment has one variable. Tags are disabled here
-  # too, deliberately: the re-dispatch job would deploy via workflow_dispatch, which we
-  # already know re-serves, and that is precisely the confound observation 2 must avoid.
-  # RESTORE to:
-  #   if: github.repository == 'DiamondLightSource/myst-version-switcher-plugin'
-  # when the probe is deleted.
-  publish:
-    needs: [lint, test, docs]
-    if: false
-    uses: ./.github/workflows/publish-dispatch.yml
-    with:
-      version-name: ${{ needs.docs.outputs.version-name }}
-    permissions:
-      contents: read
-      actions: write     # the wrapper's tag re-dispatch dispatches via gh workflow run
-      pages: write
-      id-token: write
-      statuses: write

.github/workflows/docs.yml

@@ -123,6 +123,7 @@ jobs:
           path: ${{ runner.temp }}/docs.zip
           compression-level: 0
 
-      # NOTE: the fork-PR "preview not published" hint lives in publish.yml's `warn`
-      # job (reached via the publish-dispatch.yml shim), which runs for fork PRs too —
-      # so this build job stays purely about building + uploading the docs artifact.
+      # NOTE: nothing here tells a fork PR that its docs will not be published. There is
+      # no longer anywhere sensible to say it: publish.yml excludes forks before the
+      # engine is reached, so no job runs in that case at all. This build job stays
+      # purely about building + uploading the docs artifact.