fix(fern): hydrate frozen version content in docs CI

[ayuskauskas]

Fixes #563.

Problem

fern/versions/vX.Y.Z.yml is committed, but the pages it names live under fern/versions/vX.Y.Z-content/ — build artifacts extracted from the matching chart/vX.Y.Z tag and never committed. Two of the three Fern workflows extracted them inline; fern-docs-ci.yml did not, so the first PR to register a version (#561) failed with:

[docs]: ENOENT: no such file or directory, open
'.../fern/versions/v0.19.0-content/getting-started/overview.md'

Separately, that registration PR committed fern/versions/v0.19.0-content/index.yml, which should never be tracked. Git pathspec wildcards cross / unless :(glob) magic is used, so add-paths: fern/versions/v*.yml reached one directory deeper.

Changes

• scripts/hydrate-fern-versions.sh — the extraction block, which was duplicated verbatim in publish-fern-docs.yml and fern-docs-preview-build.yml (only the error wording differed). Both now call it, as does fern-docs-ci.yml.
• fern-docs-ci.yml — gains the hydration step and fetch-tags: true on its checkout, which a bare actions/checkout@v7 did not have.
• fern/.gitignore — ignores versions/*-content/.
• publish-fern-docs.yml — add-paths tightened to :(glob)fern/versions/v*.yml.
• Both docs workflows list the script in their paths: filters, so editing it re-runs the CI that depends on it.

The gitignore and the :(glob) pathspec each independently prevent the leak; both are here because the gitignore states the intent (these are artifacts) while the pathspec keeps the bot's add-paths honest if the ignore is ever relaxed.

Note on step ordering

Hydration sits after Check MDX safety, not before. That grep scans live docs/ only. Frozen content comes from released tags and cannot be edited, so a hit inside it would fail the job with no source left to fix. The step has a comment saying so.

The same caveat applies more weakly to fern check / md check / broken-links, which now do see frozen content — unavoidable, since validating the manifest is the point. Not a practical risk today (one registered version, cut from a tree that passed CI as live docs/), but worth knowing before MAX_VERSIONS worth of tags accumulate. Flagged in #563.

Verification

Run locally against the real chart/v0.19.0 tag:

• No fern/versions/ present (today's main): clean no-op, exit 0.
• With v0.19.0.yml registered: extracted 31 .md files, including the exact path CI died on, fern/versions/v0.19.0-content/getting-started/overview.md.
• Leak, reproduced and fixed in this working tree:

  $ git add -A -- 'fern/versions/v*.yml'          # old glob, before gitignore
  fern/versions/v0.19.0-content/index.yml
  fern/versions/v0.19.0.yml
  
  $ git add -A -- ':(glob)fern/versions/v*.yml'   # after
  fern/versions/v0.19.0.yml

• shellcheck scripts/hydrate-fern-versions.sh — clean.
• make license-header-check — passes with the new script tracked.
• Workflow YAML parses; step order in fern-docs-ci.yml is MDX safety → hydrate → check → md check → broken-links.

Not run locally: fern check itself (no Fern CLI here) — CI on this PR exercises it, though on a main with no registered versions, so it proves the no-op path. The populated path is proven by the extraction test above and by re-running the publish once this lands.

Conventions

• Calling ./scripts/*.sh from a workflow matches scripts/latest-distroless.sh in agent-ci.yaml / operator-ci.yaml, including listing the script in paths:. No new pattern introduced.
• No docs/ update: no page under docs/ mentions Fern — the setup is documented entirely in the workflow header comments, which stay accurate.
• No RELEASE_NOTES.md entry: CI-only fix, nothing for a user to do or notice.

Follow-up, not in this PR

#561 still carries the stray index.yml. Once this merges, close it and re-run the publish — it regenerates the registration PR cleanly against the fixed add-paths.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-fix-fern-docs-ci-hydrate-versions.docs.buildwithfern.com/nodewright