fix(ci): deploy docs after bot-cut releases via workflow_call

.github/workflows/build-release.yml

@@ -627,6 +627,24 @@ jobs:
             ./dist/apm-windows-x86_64.zip
             ./dist/apm-windows-x86_64.zip.sha256
 
+  # Deploy the docs site after the release is published.
+  # Invoked here (rather than via the docs workflow's `release: published`
+  # trigger) because release events created by GITHUB_TOKEN do not fire
+  # downstream workflow runs -- a documented Actions safeguard against
+  # recursion. Calling docs.yml directly preserves the standard release ->
+  # docs deploy chain without needing a PAT or GitHub App token.
+  deploy-docs:
+    name: Deploy Docs
+    needs: [create-release]
+    if: github.ref_type == 'tag' && needs.create-release.outputs.is_prerelease != 'true'
+    uses: ./.github/workflows/docs.yml
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    with:
+      is_prerelease: false
+
   # GH-AW Compatibility — validates the released binary works in the
   # exact flow GitHub Agentic Workflows uses (isolated install + pack, no token).
   # Informational: runs as continue-on-error because it depends on external services

.github/workflows/docs.yml

@@ -3,8 +3,19 @@ name: Deploy Docs
 on:
   # Deploy docs only when a new APM version is released, so the published
   # site always matches the latest released binary (see microsoft/apm#641).
-  # PR runs build (no deploy) to catch breakage before merge. Manual
-  # workflow_dispatch is supported for re-publishing the current docs.
+  # Primary entrypoint is workflow_call from the CI/CD Pipeline release job
+  # (release: published does not fire when the release is created by
+  # GITHUB_TOKEN -- a documented Actions safeguard against recursion).
+  # The release: published trigger is kept as a safety net for human-cut
+  # releases. PR runs build (no deploy) to catch breakage before merge.
+  # Manual workflow_dispatch is supported for re-publishing the current docs.
+  workflow_call:
+    inputs:
+      is_prerelease:
+        description: 'Skip deploy when true (build-only). Defaults to false (deploy).'
+        required: false
+        type: boolean
+        default: false
   release:
     types: [published]
   pull_request:
@@ -45,7 +56,8 @@ jobs:
       - name: Upload build artifacts
         if: |
           github.event_name == 'workflow_dispatch' ||
-          (github.event_name == 'release' && github.event.release.prerelease == false)
+          (github.event_name == 'release' && github.event.release.prerelease == false) ||
+          (github.event_name == 'workflow_call' && inputs.is_prerelease == false)
         uses: actions/upload-pages-artifact@v3
         with:
           path: docs/dist
@@ -56,7 +68,8 @@ jobs:
     # so prerelease tags (vX.Y.Z-rc1, etc.) don't clobber published docs.
     if: |
       github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'release' && github.event.release.prerelease == false)
+      (github.event_name == 'release' && github.event.release.prerelease == false) ||
+      (github.event_name == 'workflow_call' && inputs.is_prerelease == false)
     runs-on: ubuntu-latest
     permissions:
       pages: write