feat(website): serve the released docs from a versioned copy (#2979)

.github/workflows/ci.yml

@@ -95,7 +95,45 @@ jobs:
         run: python -m pip install 'check-jsonschema==0.27.3'
 
       - name: 📋 Validate JSON Schema
-        run: check-jsonschema --check-metaschema website/src/public/schema.json
+        run: check-jsonschema --check-metaschema website/src/public/next-schema.json website/src/public/schema.json
+
+  check-latest-content:
+    name: 📚 Check latest content
+    # Pull requests only: the release commit is pushed straight to main and is
+    # the one thing allowed to rewrite these files.
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    steps:
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            // Everything cmd/release overwrites. Adding a file is fine -- that
+            // is how a blog post gets published early -- editing one is not.
+            const generated = (name) =>
+              name.startsWith('website/src/latest/') ||
+              name === 'website/src/public/schema.json' ||
+              name === 'website/src/public/schema-taskrc.json' ||
+              name === 'website/.vitepress/sidebar/latest.ts'
+
+            const files = await github.paginate(
+              github.rest.pulls.listFiles, {
+                pull_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                per_page: 100,
+              }
+            )
+            const edited = files.filter(
+              (f) => generated(f.filename) && f.status !== 'added'
+            )
+            if (edited.length > 0) {
+              core.setFailed(
+                'These files are generated by cmd/release and would be overwritten at the next release. Update their website/src counterpart instead:\n' +
+                  edited.map((f) => f.filename).join('\n')
+              )
+            }
 
   govulncheck:
     name: 🛡️ Vulnerabilities