fix(docs): point source links at public master

.github/workflows/docs-pages.yml

@@ -23,6 +23,9 @@ permissions:
 
 env:
   PRIMARY_NODE_VERSION: '24'
+  # Projected source links target the public repository, whose history can
+  # differ from this workflow's source repository.
+  DOCS_REPOSITORY_REF: master
   # CI runs must never report to the production telemetry endpoint baked
   # into apps/cli/cordis.yml (AppCLIEntry disables the row when set).
   DSH_TELEMETRY_DISABLED: '1'

scripts/project-doc-site.spec.ts

@@ -7,7 +7,7 @@ import { basename, join, resolve } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
 import { docsPages, landingLink, routeLink, sectionSpec, type DocsPage } from '../website/docs.ts'
 import {
-  addProjectionFrontmatter, projectedPageContent, publishableImage, rewriteMarkdown,
+  addProjectionFrontmatter, projectedPageContent, publishableImage, resolveRepositoryRef, rewriteMarkdown,
 } from './project-doc-site.ts'
 
 const roots: string[] = []
@@ -91,6 +91,16 @@ describe('publishableImage', () => {
   })
 })
 
+describe('resolveRepositoryRef', () => {
+  it('defaults to public master instead of a private workflow SHA', () => {
+    expect(resolveRepositoryRef({ GITHUB_SHA: 'private-sha' })).toBe('master')
+  })
+
+  it('accepts an explicit public repository ref', () => {
+    expect(resolveRepositoryRef({ DOCS_REPOSITORY_REF: 'public-sha' })).toBe('public-sha')
+  })
+})
+
 describe('rewriteMarkdown', () => {
   it('maps published pages and pins unpublished source links', () => {
     const { root, pages } = fixture()

scripts/project-doc-site.ts

@@ -19,6 +19,16 @@ const REPOSITORY_URL = 'https://github.com/deepseek-ai/deepseek-harness'
 const root = resolve(import.meta.dirname, '..')
 const generatedRoot = resolve(root, 'website/.generated')
 
+/**
+ * Resolve the public repository ref used by projected source links.
+ *
+ * @param environment Build environment containing an optional explicit public ref.
+ * @returns The configured public ref, or `master`.
+ */
+export function resolveRepositoryRef(environment: NodeJS.ProcessEnv): string {
+  return environment.DOCS_REPOSITORY_REF ?? 'master'
+}
+
 interface Replacement {
   start: number
   end: number
@@ -400,7 +410,7 @@ export function projectDocs(): void {
   const routes = new Set<string>()
   /** Projected path to the repository file that claimed it, pages and images alike. */
   const claimed = new Map<string, string>()
-  const repositoryRef = process.env.GITHUB_SHA ?? 'master'
+  const repositoryRef = resolveRepositoryRef(process.env)
   rmSync(generatedRoot, { recursive: true, force: true })
 
   /** Reserve one projected path, refusing a second source for it. */