docs(dynamic-ci): add a Dynamic CI page gated to the dynamic-ci group

[EliSchleifer]

What

Adds dynamic-ci/index.mdx — a Dynamic CI overview — carrying groups: ["dynamic-ci"] in its frontmatter, plus the Dynamic CI nav tab and a top-level "public": true in docs.json.

This is the first gated page on docs.trunk.io, and it exists as much to prove the gate as to document the product. It pairs with trunk-io/trunk2's /mintlify-login route, which signs the JWT that carries the group.

How the gating works

Mintlify serves a page naming groups only to a reader whose JWT lists one of them. Everyone else gets a 404, and the page is absent from navigation, search, and the Assistant — so it reads as "doesn't exist" rather than "you're locked out", which is what we want for an unreleased product.

The group comes from trunk2, not from here. /mintlify-login evaluates showDynamicCI (LaunchDarkly project frontend-web-2) through the same helper the app's own gates use, and emits ["dynamic-ci"] when it's on. It deliberately does not key on ciOptimizerDynamicCiEnabled (project backend-services) — that's the engine kill switch, and gating docs on it would delete a customer's documentation during the incident that flipped it.

Why "public": true at the top level

Authentication is configured in the Mintlify dashboard, not in docs.json; the only thing this file controls is what stays open. Mintlify's default once authentication is enabled is that every page requires a login. "public": true inverts that to "public by default, gated only where a page names a group", so switching authentication on doesn't put all of docs.trunk.io behind a login.

The alternative — marking each of the five existing tabs public — is the same outcome with five places to forget when a tab is added.

Content

Sourced from trunk-io/dynamic-ci-filter's README rather than written fresh, so the docs and the action can't drift on the contract. Two parts are load-bearing for correctness rather than style, and are called out as warnings:

• != 'false', never == 'true'. A job with no verdict emits no output at all; == 'true' would silently skip the whole suite the first time the service degraded.
• Merge queues. Trunk Merge Queue branches are never skipped (a trunk-merge/ prefix check, before any recommendation work), so users must not add github.event_name != 'pull_request' — draft queue PRs arrive as pull_request events. GitHub's native merge queue is not covered and needs its own gate.

The page is marked private beta up front.

Blocked on

Group-based access is a Mintlify Enterprise feature. Until the plan is upgraded and a signing key is generated:

• This page renders publicly like any other (nothing enforces the group yet).
• trunk2's /mintlify-login answers 503 — its secret is unprovisioned and degrades to an empty key, so nothing breaks in the meantime.

Once the plan lands: generate the key in the dashboard, set the login URL to https://app.trunk.io/mintlify-login, set site visibility to Private, and store the key in the mintlify-docs-auth secret in both accounts.

Testing

Toggle showDynamicCI for a test user and confirm the page appears and disappears — including from search and the nav, not just on direct navigation. Note groups are snapshotted into the JWT at login with a one-day expiresAt, so a flag flip needs a re-auth against the docs to take effect.

docs.json validates clean against https://mintlify.com/docs.json.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
trunk	🟢 Ready	View Preview	Aug 27, 2026, 10:20 PM

[mintlify]

Docs PR opened: #319

Added a changelog entry announcing the Dynamic CI private beta, synced changelog navigation, and fixed a prior entry's frontmatter.