fix(docs): publish docs.nvidia.com from 26.05 branch

[kheiss-uwzoo]

Summary

• Build the docs.nvidia.com MkDocs site from the 26.05 release branch (docs/mkdocs.yml, docs/requirements.txt, docs/docs/**) instead of main.
• Keep the canonical versions.json (version picker + latest alias) sourced from main, since it does not exist on 26.05.
• Version label remains 26.5.0; only the source of the published pages changes.

Why

The publish workflow lives on main and previously checked out the triggering ref (main), so docs.nvidia.com/nemo/retriever/26.5.0/ was being built from main. As main moves toward the next release, its docs must not be published under the 26.5.0 label. Pinning the content checkout to 26.05 fixes this while keeping the secret-bearing publish job on main (no new exposure, no 26.05 branch-protection dependency).

Triggering

Runs on push to main (docs paths), release tags, or manual workflow_dispatch — all build 26.05 content. (Auto-publish on 26.05 pushes is intentionally not added, to avoid exposing AWS/Akamai secrets to unprotected-branch pushes.)

Test plan

• Verified workflow YAML has no linter errors.
• Verified docs/mkdocs.yml and docs/requirements.txt exist on 26.05.
• Recommended first run: workflow_dispatch with dry-run: true to confirm the 26.05 build succeeds before a live publish.

[greptile-apps]

Greptile Summary

This PR changes the docs.nvidia.com publish workflow for the 26.5.0 docs. The main changes are:

• Check out docs content from the 26.05 branch.
• Check out docs/publish/versions.json from main into .docs-main-meta.
• Copy that metadata file into the generated MkDocs site before upload.

Confidence Score: 4/5

The publish workflow needs a tighter source ref before merging.

• The build job now takes docs content from the moving 26.05 branch.
• That artifact is later uploaded by the AWS/Akamai-backed publish job.
• A reviewed commit SHA or equally protected release ref would close the artifact-integrity gap.

.github/workflows/nrl-docs-nvidia-publish.yml

Security Review

The workflow does not add hardcoded secrets or echo secret values. It does, however, publish artifacts built from a mutable 26.05 ref, so branch protection and release review controls need to cover that source before the secret-backed publish job uploads the site.

Important Files Changed

Filename	Overview
.github/workflows/nrl-docs-nvidia-publish.yml	The workflow now builds docs from 26.05 while sourcing versions.json from main; the changed checkout ref needs stronger immutability or protection before publishing.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
.github/workflows/nrl-docs-nvidia-publish.yml:153
**Mutable Release Branch Publishes Content**

When this workflow runs from `main`, the docs artifact is now built from the current tip of `26.05` and then published by the later AWS/Akamai-backed job. If `26.05` can change outside the same protected release review path as `main`, a later push, tag, or manual dispatch on `main` can publish unreviewed docs content under the trusted `26.5.0` URL.

_{Reviews (1): Last reviewed commit: "fix(docs): publish docs.nvidia.com from ..." | Re-trigger Greptile}

[greptile-apps]

Mutable Release Branch Publishes Content

When this workflow runs from main, the docs artifact is now built from the current tip of 26.05 and then published by the later AWS/Akamai-backed job. If 26.05 can change outside the same protected release review path as main, a later push, tag, or manual dispatch on main can publish unreviewed docs content under the trusted 26.5.0 URL.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/nrl-docs-nvidia-publish.yml
Line: 153

Comment:
**Mutable Release Branch Publishes Content**

When this workflow runs from `main`, the docs artifact is now built from the current tip of `26.05` and then published by the later AWS/Akamai-backed job. If `26.05` can change outside the same protected release review path as `main`, a later push, tag, or manual dispatch on `main` can publish unreviewed docs content under the trusted `26.5.0` URL.

How can I resolve this? If you propose a fix, please make it concise.