Fix release/S3 pipeline so docs/api and generated reports fully publish to production

[Copilot]

riksdagsmonitor.com/docs/api/** and many docs/** pages were 403ing because the S3 deploy never ran automatically after a release and the committed docs/api tree was stale relative to what TypeDoc actually generates (1145 committed files vs. 2361+ produced by a fresh build).

Root causes

• deploy-s3.yml had regressed to workflow_dispatch-only, contradicting its own documented push: branches: [main] trigger (WORKFLOWS.md §4.2) — production S3 never auto-redeployed after release.yml pushed fresh docs to main.
• release.yml's docs staging used shell globs (rm -rf docs/api/*, cp -r api/*) which silently skip dotfiles, dropping TypeDoc's .nojekyll.
• scripts/deploy-s3.sh had no fallback for file types outside its explicit --include lists (e.g. .yml/.ts "media" assets TypeDoc copies from projectDocuments), so anything not enumerated 403'd.
• typedoc.json / tsconfig.typedoc.json excluded **/*.cjs and a single .ts file from documentation for no functional reason, leaving valid source undocumented.

Changes

• deploy-s3.yml: restored push: branches: [main] trigger alongside workflow_dispatch; added a concurrency group so overlapping pushes serialize instead of racing S3 sync / CloudFront invalidation.
• release.yml: replaced rm -rf dir/* / cp -r api/* with rm -rf dir && mkdir -p dir / cp -r api/. so dotfiles are cleaned and copied correctly.
• scripts/deploy-s3.sh: added .yml/.yaml/.ts to the metadata sync pass, and replaced the previous type-enumerated catch-all with a fully unconditional final sync pass — every remaining file, any extension, any dotfile, now reaches S3 regardless of whether it was anticipated:

  # any file not matched by an earlier typed pass still gets uploaded
  aws s3 sync "$SRC" "$BUCKET" \
    --cache-control 'public, max-age=86400' \
    "${SKIP[@]}"

• typedoc.json / tsconfig.typedoc.json: dropped the blanket **/*.cjs exclude (added scripts/**/*.cjs to the tsconfig include) and the single-file exclude for scripts/strip-in-method-comments.ts — both now document cleanly with 0 build errors. Left coalition-dashboard/committees-dashboard excluded after confirming (via a local build) they carry ~139 pre-existing real TypeScript errors that would break the typedoc job.
• Verified .gitignore's /api/ entry is correctly anchored (a prior unanchored api/ had silently blocked all docs/api/** commits).

[github-actions]

🏷️ Automatic Labeling Summary

This PR has been automatically labeled based on the files changed and PR metadata.

Applied Labels: workflow,ci-cd,deployment,refactor,size-m

Label Categories

• 🗳️ Content: news, dashboard, visualization, intelligence
• 💻 Technology: html-css, javascript, workflow, security
• 📊 Data: cia-data, riksdag-data, data-pipeline, schema
• 🌍 I18n: i18n, translation, rtl
• 🔒 ISMS: isms, iso-27001, nist-csf, cis-controls
• 🏗️ Infrastructure: ci-cd, deployment, performance, monitoring
• 🔄 Quality: testing, accessibility, documentation, refactor
• 🤖 AI: agent, skill, agentic-workflow

For more information, see .github/labeler.yml.

[github-actions]

🔍 Lighthouse Performance Audit

Category	Score	Status
Performance	85/100	🟡
Accessibility	95/100	🟢
Best Practices	90/100	🟢
SEO	95/100	🟢

📥 Download full Lighthouse report

Budget Compliance: Performance budgets enforced via budget.json

[Copilot]

Pull request overview

Fixes production S3/CloudFront publishing drift that caused riksdagsmonitor.com/docs/api/** (and other docs/** assets) to 403 by restoring automatic deploy triggers, ensuring dotfiles (notably .nojekyll) are staged correctly, and making the S3 sync logic extension-agnostic so unexpected file types are still published.

Changes:

• Restore deploy-s3.yml auto-deploy on push to main and serialize deploys via workflow-level concurrency.
• Fix release.yml docs staging to fully clean/copy directories including dotfiles (cp -r api/.).
• Expand scripts/deploy-s3.sh sync coverage (explicit .yml/.yaml/.ts) and add a catch-all final sync pass to upload any remaining files regardless of extension.
• Broaden TypeDoc coverage by removing the blanket **/*.cjs exclusion and including scripts/**/*.cjs in the typedoc tsconfig.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
typedoc.json	Removes **/*.cjs and a single-file exclude to increase documented surface while keeping known-broken dashboards excluded.
tsconfig.typedoc.json	Includes scripts/**/*.cjs so TypeDoc can process CommonJS script files.
scripts/deploy-s3.sh	Ensures .yml/.yaml/.ts get synced and adds an unconditional catch-all sync pass to prevent future 403s from unanticipated extensions/dotfiles.
.github/workflows/release.yml	Changes docs cleanup/copy to preserve dotfiles (notably .nojekyll) during release staging.
.github/workflows/deploy-s3.yml	Restores push-to-main trigger and adds concurrency to prevent overlapping deploy races.

[github-actions]

🔍 Lighthouse Performance Audit

Category	Score	Status
Performance	85/100	🟡
Accessibility	95/100	🟢
Best Practices	90/100	🟢
SEO	95/100	🟢

📥 Download full Lighthouse report

Budget Compliance: Performance budgets enforced via budget.json