fix(ci): use code-block-aware MDX sanitization in Fern workflows

Blind sed escaping of {, }, < corrupts content inside fenced code
blocks — bash scripts with ${VAR}, Go templates with {{.Field}}, and
JSON all render with visible backslash escapes on the published site.

Replace with awk that tracks fence state and skips inline code spans.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: pdmack

.github/workflows/fern-docs-preview-build.yml

@@ -68,10 +68,27 @@ jobs:
             if git show-ref --verify --quiet "refs/tags/${version}"; then
               mkdir -p "fern/versions/${version}-content"
               git archive "refs/tags/${version}" -- docs/ | tar -x --strip-components=1 -C "fern/versions/${version}-content"
-              find "fern/versions/${version}-content" -name '*.md' -print0 | xargs -0 sed -i \
-                -e 's/{/\\{/g' \
-                -e 's/}/\\}/g' \
-                -e 's/</\&lt;/g'
+              # Escape {, }, < for MDX — but only outside fenced code blocks and inline code spans
+              find "fern/versions/${version}-content" -name '*.md' -print0 | while IFS= read -r -d '' f; do
+                awk '
+                  /^````*/ || /^~~~~*/ { fence = !fence; print; next }
+                  fence { print; next }
+                  {
+                    n = split($0, p, "`")
+                    out = ""
+                    for (i = 1; i <= n; i++) {
+                      if (i % 2 == 1) {
+                        gsub(/{/, "\\{", p[i])
+                        gsub(/}/, "\\}", p[i])
+                        gsub(/</, "\\&lt;", p[i])
+                      }
+                      out = out p[i]
+                      if (i < n) out = out "`"
+                    }
+                    print out
+                  }
+                ' "$f" > "${f}.tmp" && mv "${f}.tmp" "$f"
+              done
               echo "Extracted docs from $version"
             else
               echo "::warning::Tag $version not found — skipping content checkout"

.github/workflows/publish-fern-docs.yml

@@ -184,14 +184,27 @@ jobs:
             if git show-ref --verify --quiet "refs/tags/${version}"; then
               mkdir -p "fern/versions/${version}-content"
               git archive "refs/tags/${version}" -- docs/ | tar -x --strip-components=1 -C "fern/versions/${version}-content"
-              # Sanitize frozen markdown for Fern's MDX parser.
-              # Versioned content gets strict MDX parsing; escape all bare
-              # { } and < so nothing is interpreted as JSX. Markdown renders
-              # &lt; as < and \{ as { so the output is visually identical.
-              find "fern/versions/${version}-content" -name '*.md' -print0 | xargs -0 sed -i \
-                -e 's/{/\\{/g' \
-                -e 's/}/\\}/g' \
-                -e 's/</\&lt;/g'
+              # Escape {, }, < for MDX — but only outside fenced code blocks and inline code spans
+              find "fern/versions/${version}-content" -name '*.md' -print0 | while IFS= read -r -d '' f; do
+                awk '
+                  /^````*/ || /^~~~~*/ { fence = !fence; print; next }
+                  fence { print; next }
+                  {
+                    n = split($0, p, "`")
+                    out = ""
+                    for (i = 1; i <= n; i++) {
+                      if (i % 2 == 1) {
+                        gsub(/{/, "\\{", p[i])
+                        gsub(/}/, "\\}", p[i])
+                        gsub(/</, "\\&lt;", p[i])
+                      }
+                      out = out p[i]
+                      if (i < n) out = out "`"
+                    }
+                    print out
+                  }
+                ' "$f" > "${f}.tmp" && mv "${f}.tmp" "$f"
+              done
               echo "Extracted docs from $version"
             else
               echo "::error::Tag $version not found — cannot pin frozen docs content"