ci: Fix documentation artefacts automatically

[emyller]

Human text.

Closes #8021

The team has been made responsible to include auto-generated documentation changes in their PRs, leading to some time wasted in back-and-forth make targets and git-fu — not to mention the need to authenticate to AWS for CodeArtefact (private packages). This breaks us free!

Changes

• Pull requests no longer fail when documentation artefacts are outdated.
• Documentation artefacts are regenerated and committed automatically to the pull request.

Review effort: 2/5

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 17, 2026 7:29pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ignored	Preview	Jul 17, 2026 7:29pm
flagsmith-frontend-staging	Ignored	Preview	Jul 17, 2026 7:29pm

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.64%. Comparing base (b51e6b7) to head (b4d8473).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #8024    +/-   ##
========================================
  Coverage   98.64%   98.64%            
========================================
  Files        1501     1506     +5     
  Lines       59397    59572   +175     
========================================
+ Hits        58591    58766   +175     
  Misses        806      806            

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (1)

.github/workflows/api-fix-docs-artefacts.yml (1)

61-71: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Improve commit step reliability and prevent redundant CI runs.

Since this workflow authenticates using a GitHub App token with push access, the resulting push will re-trigger this and any other on: pull_request CI workflows. Appending [skip ci] to the commit message prevents these redundant and potentially expensive CI executions.

Additionally, while git add --all operates on the entire working tree regardless of the current directory in Git 2.0+, explicitly setting the working directory to the repository root makes it much clearer that this step expects to commit changes in both the api/ and docs/ folders.

♻️ Proposed refactor

       - name: Commit and push fixes
+        working-directory: ${{ github.workspace }}
         run: |
           git add --all
           if git diff --cached --quiet; then
             echo "Documentation artefacts are up to date."
             exit 0
           fi
           git config user.name '${{ steps.app-token.outputs.app-slug }}[bot]'
           git config user.email '${{ steps.app-token.outputs.app-slug }}[bot]`@users.noreply.github.com`'
-          git commit --message 'chore: Update documentation artefacts'
+          git commit --message 'chore: Update documentation artefacts [skip ci]'
           git push || { git pull --rebase && git push; }

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6d082014-2688-438c-8ca6-1a53d0b223a1

📥 Commits

Reviewing files that changed from the base of the PR and between e61a1a6 and db5ee9a.

📒 Files selected for processing (2)

• .github/workflows/api-fix-docs-artefacts.yml
• api/Makefile

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/api-fix-docs-artefacts.yml (1)

37-59: 🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift

Do not execute PR code with privileged credentials.

The workflow checks out attacker-controlled PR content using a push-capable App token, runs Make targets from that checkout, then exports production CodeArtifact credentials before running another PR-controlled Make target. A malicious PR can modify the Makefile or management command to push arbitrary changes or exfiltrate the CodeArtifact token. Run generation only from a trusted post-merge checkout, or isolate PR validation from all write-capable tokens and secrets.

♻️ Duplicate comments (1)

.github/workflows/api-fix-docs-artefacts.yml (1)

8-11: 🎯 Functional Correctness | 🟠 Major

Run this job after merging, not on pull requests.

This still triggers on pull_request and pushes generated commits back to the PR branch, contradicting the stated objective that artefacts are regenerated after merging to the default branch. Move this job to a post-merge default-branch workflow.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4ea38dab-62d5-4913-8684-a0f7a98334bf

📥 Commits

Reviewing files that changed from the base of the PR and between c574255 and 0d3bb9d.

📒 Files selected for processing (2)

• .github/workflows/api-fix-docs-artefacts.yml
• api/Makefile

[emyller]

Is there a way to run pre-commit hooks in a runtime we need in CI? This would allow us to rely on hooks more rather than less, and lean on standardised CI vs introducing another custom workflow.

After experimenting a few paths, I think I prefer keeping this a new GHA workflow mainly because a pre-commit hook would require every engineer to authenticate to CodeArtifact, which IMO is not necessary.

I did improve things a bit (a35b11c) but still not a hook — it would be a manual one, which I think is worse than a make target.

Please advise if you see something I can't, otherwise I think the DevEx gain here easily warrants a new CI workflow.