[Flosk6]

What and why

https://spawner.run builds its documentation from the latest release of Spawner. Today it notices a release at its daily build, up to a day later, and GitHub stops scheduled workflows after 60 days without activity in a public repository: the site could stop following the releases without a word.

Once the GitHub release of a stable version exists, the release job now sends a repository_dispatch (spawner-release) to Flosk6/spawner-site, whose deploy workflow already listens for it.

• The token is SITE_DISPATCH_TOKEN, a secret of the release environment rather than of the repository: only the release job, which a reviewer approves, reads it. It is a fine-grained token limited to Flosk6/spawner-site, with Contents in read and write, the only permission repository_dispatch accepts. It is a step of the existing release job, so no third approval.
• Without the token, or once it expires, the step prints a notice and the release goes on (continue-on-error); the daily build still follows the release. Prereleases do not trigger it, since the site follows the latest stable release.
• scripts/README.md and architecture.md say so.

Checks

• Tests next to the code, a compose fixture for a policy change, or an end-to-end check

• Documentation and CHANGELOG.md updated when the behaviour changes (nothing users notice: no changelog line)

• release.yml is valid YAML; the new step's script passes bash -n.

• Not run yet: the first stable release after this merges sends the event. The receiving side (the site's deploy on repository_dispatch) is checked once 2.2.0 is out.