ci: add Deploy Static Docs workflow (docs-static-build container → CF Pages)

[thesandlord]

Summary

Adds .github/workflows/deploy-static-docs.yml, which renders the published docs site to static HTML and uploads it to Cloudflare Pages using the public fernenterprise/docs-static-build container (added in fern-platform).

It runs after the existing Publish Docs workflow completes successfully — so the ledger manifest + CAS blobs the container reads from S3 are already fresh — and is also manually runnable via workflow_dispatch (with an image_tag input, default latest).

The container's three logical inputs. The docs URL, AWS region, and prod ledger bucket names are hardcoded; only the credentials come from GitHub secrets:

NEXT_PUBLIC_DOCS_DOMAIN = fern.docs.buildwithfern.com/learn          # 1. docs URL
AWS_REGION = us-east-1                                              # 2. S3: read ledger blobs
DOCS_DEFINITION_S3_BUCKET_NAME = fdr-prod-docs-definitions-public
CONTENT_ADDRESSABLE_FILES_S3_BUCKET_NAME = fdr-prod-content-addressable-storage
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY                           # (secrets)
CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID / CF_PAGES_PROJECT     # 3. CF Pages: upload (secrets)
CF_PAGES_BRANCH (optional secret) / FERN_TOKEN (optional, Ask AI)

Job shape:

on:
  workflow_run: { workflows: ["Publish Docs"], types: [completed] }
  workflow_dispatch: { inputs: { image_tag: latest } }
permissions: {}
jobs.deploy:
  if: dispatch || workflow_run.conclusion == 'success'
  run: docker pull $IMAGE && docker run --rm -e ... $IMAGE   # forwards secrets by name

Secrets are forwarded to the container by name (docker run -e VAR, values from the step env:) rather than interpolated into the command line, and the job requests no token permissions.

Required repo secrets (configure before the first run): AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, CF_PAGES_PROJECT (optional: CF_PAGES_BRANCH). FERN_TOKEN already exists.

Testing

• zizmor --offline passes (the workflow_run dangerous-triggers finding is suppressed inline with a safety justification: no untrusted checkout, permissions: {}, only runs the public container).
• YAML parses.
• End-to-end run pending the secrets being added to the repo.

Link to Devin session: https://app.devin.ai/sessions/91dba5ee2dda4ff198a3cc4e3b23fa51
Requested by: @thesandlord

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

🌿 Preview your docs: https://fern-preview-devin-1784834646-static-docs-cf-deploy.docs.buildwithfern.com/learn