Skip to content

Deploy the docs from a separate job with the only write token - #118

Open
mmlado wants to merge 1 commit into
mainfrom
ci/docs-deploy-least-privilege
Open

mmlado wants to merge 1 commit into
mainfrom
ci/docs-deploy-least-privilege

Conversation

@mmlado

@mmlado mmlado commented Nov 6, 2026

Copy link
Copy Markdown
Collaborator

Splits the docs workflow into a build job and a deploy job. The workflow's token is read-only; build-docs keeps its name and, on a push to main, uploads the built site as a one-day artifact; the new deploy-docs job, the only one with contents: write, exists only on pushes to main, downloads the artifact and pushes gh-pages. Pull request runs, which execute code from the pull request, no longer hold a write-capable token.

Two new actions, SHA-pinned: actions/upload-artifact v7.0.2 and actions/download-artifact v8.0.2. What a push to main deploys is unchanged; the deploy job is exercised by the first push to main after the merge.

🤖 Generated with Claude Code

The build job runs with a read-only token and uploads the built site;
a deploy job that exists only on pushes to main downloads it and pushes
gh-pages. Pull request runs, which execute code from the pull request,
no longer hold a write-capable token.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@mmlado
mmlado requested a review from embarquech as a code owner November 6, 2026 16:25
@mmlado mmlado self-assigned this Nov 6, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant