Either directly via GitHub Actions or indirectly via gcloud calls to Firebase.
One thing that was pretty useful in the dalek context was running two doc builds: one normal one and one with --document-private-items, hosted on, say doc.domain doc-internal.domain (or any two different paths); having linkable rendered docs of private internals is very useful.
So would those private items docs be behind an auth'd page? Or just a different page, explicitly about internals?
I think just a different page is fine, since they're not any more secret than the rest of the codebase, it's just that they're not exported.
Now live at https://doc.zebra.zfnd.org