docs

ci: set contents read as default workflow permissions #324

	name: docs

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
	permissions:
	contents: read

	on:
	workflow_dispatch:
	push:
	tags:
	- 'v*'
	pull_request:

	env:
	DESTDIR: ./bin
	DOCKER_BUILD_SUMMARY: false

	jobs:
	publish:
	runs-on: ubuntu-latest
	permissions:
	# required to push to gh-pages
	contents: write
	steps:
	-
	name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0
	-
	name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3
	-
	name: Build docs
	uses: docker/bake-action@v5
	with:
	provenance: false
	targets: docs
	-
	name: Check GitHub Pages status
	uses: crazy-max/ghaction-github-status@v4
	with:
	pages_threshold: major_outage
	-
	name: Deploy
	if: github.event_name != 'pull_request'
	uses: crazy-max/ghaction-github-pages@v4
	with:
	target_branch: gh-pages
	build_dir: ${{ env.DESTDIR }}/site
	jekyll: false
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback