Uncomment deploy step in GitHub Actions workflow#9
Conversation
There was a problem hiding this comment.
Pull request overview
Re-enables the GitHub Pages deployment step in the release documentation workflow so that generated release artifacts are automatically published to the external documentation repository.
Changes:
- Uncomment and reintroduce the
Deploy 🚀step usingJamesIves/github-pages-deploy-action@v4. - Deploy the
output/directory toOE5XRX/OE5XRX.github.iounderdocs/remote-station/hardware/${{ github.event.repository.name }}.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # target-folder: docs/remote-station/hardware/${{ github.event.repository.name }} | ||
| # clean: true | ||
| - name: Deploy 🚀 | ||
| uses: JamesIves/github-pages-deploy-action@v4 |
There was a problem hiding this comment.
This deploy step grants a long-lived secret (DEPLOY_GH_TOKEN) to a third-party action. To reduce supply-chain risk, consider pinning JamesIves/github-pages-deploy-action to a specific commit SHA (or at least a fully qualified release tag) rather than @v4, since this step can push to another repository.
| uses: JamesIves/github-pages-deploy-action@v4 | |
| uses: JamesIves/github-pages-deploy-action@v4.6.0 |
| - name: Deploy 🚀 | ||
| uses: JamesIves/github-pages-deploy-action@v4 | ||
| with: | ||
| token: ${{ secrets.DEPLOY_GH_TOKEN }} |
There was a problem hiding this comment.
DEPLOY_GH_TOKEN should be a fine-grained PAT scoped only to OE5XRX/OE5XRX.github.io with the minimal permissions required for this deploy (and ideally stored behind a protected GitHub Environment). This workflow runs on release: published, so tightening token scope and gating helps limit blast radius if the workflow is triggered unexpectedly.
| token: ${{ secrets.DEPLOY_GH_TOKEN }} | |
| token: ${{ secrets.GITHUB_TOKEN }} |
| - name: Deploy 🚀 | ||
| uses: JamesIves/github-pages-deploy-action@v4 | ||
| with: | ||
| token: ${{ secrets.DEPLOY_GH_TOKEN }} | ||
| repository-name: OE5XRX/OE5XRX.github.io | ||
| branch: main | ||
| folder: output | ||
| target-folder: docs/remote-station/hardware/${{ github.event.repository.name }} | ||
| clean: true |
There was a problem hiding this comment.
Consider adding an explicit permissions: block (workflow- or job-level) to enforce least-privilege for the GITHUB_TOKEN. Right now this workflow relies on the repository default permissions, but the job performs a deployment and uses several secrets, so being explicit makes permission changes safer/auditable.
No description provided.