trunk/7098fc1dae6590bf1eccebb297207414a2623a0f: Upload docs preview from a workflow_run job, not the OSDC pod (#184414)

Summary

• The OSDC (k8s pod) docs build cannot upload docs previews to S3: fork PRs cannot authenticate via OIDC from the build job, and we don't want to grant the pod's IAM role S3 write access on doc-previews/.


• Move the upload out of the build pod. build-docs-osdc now stages the built docs as a GHA artifact (docs-preview-osdc-<docs_type>) along with a pr-metadata.txt that records the PR number.


• A new upload-docs-preview workflow is triggered by workflow_run on completion of the pull workflow. It runs in the base-repo context (full OIDC + secrets), downloads the staged artifact, and performs the aws s3 sync to s3://doc-previews/pytorch/pytorch/<PR#>[/cppdocs]. This works for fork PRs.


• The EC2 docs upload path (which uses the EC2 instance profile credentials) is unchanged.


• The C++ docs coverage PR comment stays in _docs.yml but is now gated on the PR being from a branch in the base repo, so the read-only fork GITHUB_TOKEN no longer causes spurious failures.


• The OSDC nightly C++ dry-run upload step is removed; if needed it can be restored later by extending the new uploader to trigger on additional workflows.

Follow-ups (out of scope here)

• Update the trust policy of arn:aws:iam::308535385114:role/arc so it can be assumed from this workflow_run workflow (the OIDC subject points to the base repo, so this should already be compatible).


• Optionally drop S3 write to doc-previews/ from the OSDC pod's IAM policy now that the pod no longer uploads.

Test plan

• Open a same-repo PR after this lands; verify docs-preview-osdc-python and docs-preview-osdc-cpp artifacts are produced by linux-docs.


• Verify the Upload docs preview workflow_run job runs to completion and uploads to s3://doc-previews/pytorch/pytorch/<PR#>/ and <PR#>/cppdocs/.


• Verify the preview URLs resolve: https://docs-preview.pytorch.org/pytorch/pytorch/<PR#>/index.html and .../<PR#>/cppdocs/index.html.


• Open a fork PR (or simulate one); confirm the artifacts upload and the workflow_run uploader still publishes the preview (previously the OSDC path silently no-op'd).


• Confirm the C++ coverage comment still posts on same-repo PRs touching docs/cpp/, and skips cleanly on fork PRs without producing a failed step.

Authored by Claude.

Pull Request resolved: