Skip to content

ci: standardize docs workflow #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
stefan-jansen wants to merge 1 commit into from
Closed

ci: standardize docs workflow #18

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 5 additions & 6 deletions .github/workflows/docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,15 @@ jobs:
build:
name: Build & Deploy Docs
runs-on: ubuntu-latest
env:
DOCS_DEPLOY_KEY: ${{ secrets.DOCS_DEPLOY_KEY }}
Comment on lines +19 to +20

Copilot AI Apr 29, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DOCS_DEPLOY_KEY is being exported at the job level, which makes the deploy key available to every step (including third-party actions like actions/checkout and astral-sh/setup-uv). To follow least-privilege, scope the secret to only the deploy step and use if: ${{ secrets.DOCS_DEPLOY_KEY != '' }} (or similar) instead of routing it through env at the job level.

Copilot uses AI. Check for mistakes.
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0

- name: Install uv
uses: astral-sh/setup-uv@v8
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: "latest"

Expand All @@ -33,16 +35,13 @@ jobs:
run: uv sync --dev --extra docs

- name: Build docs
# The docs tree includes archived/reference pages and legacy relative
# links that are useful to keep but currently emit MkDocs warnings.
# Build failures should still stop deployment; warning cleanup can be
# handled separately without blocking docs publication.
run: uv run mkdocs build

- name: Deploy to website repo
if: ${{ env.DOCS_DEPLOY_KEY != '' }}
uses: cpina/github-action-push-to-another-repository@v1.7.2

Copilot AI Apr 29, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cpina/github-action-push-to-another-repository@v1.7.2 is a third-party action referenced by a movable tag. Since this workflow uses an SSH deploy key, consider pinning this action to an exact commit SHA (and optionally documenting the corresponding version) to reduce supply-chain risk from tag retargeting.

Copilot uses AI. Check for mistakes.
env:
SSH_DEPLOY_KEY: ${{ secrets.DOCS_DEPLOY_KEY }}
SSH_DEPLOY_KEY: ${{ env.DOCS_DEPLOY_KEY }}
with:
source-directory: site/
destination-github-username: ml4t
Expand Down
Loading