ci(pages): restrict deploy-pages workflow to push and workflow_dispatch; remove id-token from permissions

[AAdewunmi]

Summary

Restrict the GitHub Pages deployment workflow so it only runs on pushes to main and manual dispatch, and remove id-token: write from workflow-level permissions to avoid failures and accidental deployments from pull requests (especially forks).

Changes

• Update deploy-pages.yml:
  • Remove the pull_request trigger; add workflow_dispatch for manual runs.
  • Keep push: branches: [ main ].
  • Remove id-token: write from the workflow permissions.
  • Keep contents: read and pages: write (required for deployment).

Behaviour

• The workflow runs only when code is pushed to main or when manually triggered.
• Pull request events no longer trigger the Pages deployment workflow.
• Workflow-level token requests that fail on forked PRs are removed, reducing false failures.

Why

• Forked PRs do not have pages / id-token permissions, causing the workflow to fail or produce confusing status checks.
• Running deploy steps on pull_request risks deploying unreviewed code or exposing sensitive tokens.
• Narrowing the trigger surface makes the deployment safer and more reviewable.

Validation

• Confirm file updated: deploy-pages.yml.
• Confirm branch fix-deploy-pages contains only this workflow change.
• After merge (or manual dispatch), verify:
  • A manual workflow_dispatch run completes successfully on main.
  • No Pages deploy runs trigger for PRs from forks.
  • Status checks for unrelated PRs are no longer failing due to Pages permissions.

Result

A minimal, reviewable change that prevents Pages deployment runs on PRs (especially forks), reduces CI failures and accidental deployments, and prepares the workflow for further hardening.

Notes

• This PR is intentionally small; follow-up PRs should:
  • Pin used Actions to immutable commit SHAs for supply-chain stability.
  • Optionally add finer-grained per-job permissions or repository-only conditions if deploy validation on same-repo PRs is desired.

[Copilot]

Pull request overview

This PR updates the GitHub Pages deployment workflow to reduce the risk of deployments from pull requests (especially forks) by limiting when the workflow can run and tightening the workflow’s permission surface.

Changes:

• Restrict the workflow trigger to push on main and manual workflow_dispatch.
• Remove workflow-level id-token: write permission and keep contents: read / pages: write.
• Keep a single deploy job using the standard Pages actions (configure-pages, upload-pages-artifact, deploy-pages).

Show a summary per file

File	Description
.github/workflows/deploy-pages.yml	Adds/updates the Pages deploy workflow to run on main pushes and manual dispatch with adjusted permissions.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Low

[leestott]

@AAdewunmi thanks for splitting the PRs please comment above

Please make changes and then request copilot review

[AAdewunmi]

Hi @leestott, thanks for the review.

The workflow has been updated.

• Removed id-token: write from deploy-pages.yml
• Kept on: push and workflow_dispatch
• Pushed the fix-deploy-pages branch

The PR is now ready for Copilot review.