Drop Docker, build through the published CLI

[abernier]

Stacked on #574.

npx @pmndrs/docs build does what the image did, so the image and everything that maintained it goes.

What goes

• Dockerfile, .dockerignore
• the four ci.yml steps that logged in, built, pushed and attested the image — and the packages, attestations and id-token permissions they alone needed
• the 25-line -e VAR list in build.yml and in preview.sh: the CLI runs in the same process, so it reads the environment directly

What stays the same

build.yml keeps every input, every environment variable and the same Pages artifact. Only the build step changes:

- uses: actions/setup-node@v6
  with:
    node-version: 24
- run: npx -y @pmndrs/docs@${{ inputs.version }} build "${{ inputs.mdx }}" out --format website

docker_tag gives way to version — an npm version or range.

Why major

Not the inputs. All the repositories calling this workflow were checked: every one pins @v2 or @v3, none uses @main, and none passes docker_tag. Removing that input breaks nobody.

The major is for the git tag. Releases run git tag -fa v$MAJOR_VERSION --force, so a minor would slide zustand, react-three-fiber, drei and react-postprocessing — all pinned at @v3 — straight onto the Docker-free workflow. Only a major leaves v3 where it is and opens v4.

The substantive removal is the published artifact: ghcr.io/pmndrs/docs stops being pushed. Existing tags stay in the registry, frozen.

This repository is the canary

docs.yml now passes version: 'latest' instead of a number. Our own Pages deploy is then built by exactly what consumers install, so a broken release surfaces here before any downstream repository moves to @v4.

Verified

The artifact layout is the one thing that genuinely moved (docs/out$BASE_PATH → out), so it was built for real with BASE_PATH=/toto: out/index.html and out/guide/start.html at the artifact root, asset URLs carrying /toto — the same shape the Docker path produced.

lint, tsc, 108 unit tests green. All three workflows parse.

Sequencing

Merge only once #574 has merged and a release has actually published @pmndrs/docs to npm — which needs the NPM_TOKEN repository secret.

Consumer repositories move to @v4 afterwards, one at a time. Note that none of their docs workflows triggers on pull_request, so a migration PR carries no CI signal — hence the canary above. pmndrs/sky and pmndrs/denoiser run the image inline rather than through this workflow and need their own conversation.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HfCBpbazo3fr1n2EUXNyh5