ci: Replace third-party GitHub Actions with trusted alternatives

[mtrezza]

Summary

Replace untrusted third-party GitHub Actions with official alternatives to reduce supply chain attack surface.

Changes

• Replace peaceiris/actions-gh-pages with official actions/configure-pages + actions/upload-pages-artifact + actions/deploy-pages pipeline

Note

The repository Pages source setting must be changed to "GitHub Actions" in Settings > Pages.

Summary by CodeRabbit

• Chores
  • Updated documentation deployment workflow configuration to utilize official GitHub Pages Actions for deployments.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 42bbe812-eff2-4df5-b4c9-3a0513052a56

📥 Commits

Reviewing files that changed from the base of the PR and between 6fe0d97 and da2c5e4.

📒 Files selected for processing (2)

• .github/workflows/release-automated.yml
• .github/workflows/release-manual-docs.yml

---

📝 Walkthrough

Walkthrough

Updated GitHub Pages deployment configuration in two release workflows, replacing the third-party peaceiris/actions-gh-pages@v3 action with the official GitHub Pages Actions sequence (configure-pages, upload-pages-artifact, deploy-pages) and adding appropriate job permissions and environment configuration.

Changes

Cohort / File(s)	Summary
GitHub Pages Deployment Workflow Updates .github/workflows/release-automated.yml, .github/workflows/release-manual-docs.yml	Replaced third-party Pages action with official GitHub Actions workflow: actions/configure-pages@v5, actions/upload-pages-artifact@v4 (targeting ./docs), and actions/deploy-pages@v4. Added job-level permissions (contents: read, pages: write, id-token: write) and github-pages environment with URL sourced from deployment step output.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The PR description provides a summary, specific changes made, and an important note. However, it deviates from the repository template by omitting required sections like 'Issue Description' (Closes), 'Approach' details, and 'TODOs before merging'.	Align the description with the template by including issue reference, detailed approach explanation, and any relevant TODOs. Alternatively, clarify if the template does not apply to this workflow automation change.
Engage In Review Feedback	❓ Inconclusive	Cannot assess engagement with review feedback on PR #1886 without access to GitHub PR comment thread and review interactions.	Provide GitHub PR review comments and feedback history for PR #1886 or verify engagement directly on GitHub.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title 'ci: Replace third-party GitHub Actions with trusted alternatives' starts with the required 'ci:' prefix and clearly describes the main change of replacing untrusted third-party actions with official alternatives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Security Check	✅ Passed	Changes improve security by replacing third-party action with official GitHub-maintained actions, reducing supply chain attack surface. Workflows implement security best practices including job-level permissions with least privilege, environment-based protection, and secure token handling. No security vulnerabilities identified.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 actionlint (1.7.12)

.github/workflows/release-automated.yml

could not read ".github/workflows/release-automated.yml": open .github/workflows/release-automated.yml: no such file or directory

.github/workflows/release-manual-docs.yml

could not read ".github/workflows/release-manual-docs.yml": open .github/workflows/release-manual-docs.yml: no such file or directory

🔧 YAMLlint (1.38.0)

.github/workflows/release-automated.yml

[Errno 2] No such file or directory: '.github/workflows/release-automated.yml'

.github/workflows/release-manual-docs.yml

[Errno 2] No such file or directory: '.github/workflows/release-manual-docs.yml'

🔧 Checkov (3.2.513)

.github/workflows/release-automated.yml

2026-04-04 18:25:03,437 [MainThread ] [ERROR] Template file not found: .github/workflows/release-automated.yml
2026-04-04 18:25:03,442 [MainThread ] [ERROR] Template file not found: .github/workflows/release-automated.yml
2026-04-04 18:25:03,519 [MainThread ] [ERROR] Template file not found: .github/workflows/release-automated.yml
2026-04-04 18:25:03,520 [MainThread ] [ERROR] Failed to invoke function /usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner. with .github/workflows/release-automated.yml
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 88, in func_wrapper
result = original_func(item)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner.py", line 74, in
results = parallel_runner.run_function(lambda f: (f, self._parse_file(f)), files_to_load)

... [truncated 9249 characters] ...

cess file .github/workflows/release-automated.yml
2026-04-04 18:25:03,628 [MainThread ] [ERROR] Exception traceback:
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/main.py", line 647, in run
self.scan_reports = runner_registry.run(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/runner_registry.py", line 177, in run
for result in parallel_runner_results:
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 118, in _run_function_multiprocess_fork
raise v.internal_exception.with_traceback(v.internal_exception.traceback)
FileNotFoundError: [Errno 2] No such file or directory: '.github/workflows/release-automated.yml'

.github/workflows/release-manual-docs.yml

2026-04-04 18:25:03,440 [MainThread ] [ERROR] Template file not found: .github/workflows/release-manual-docs.yml
2026-04-04 18:25:03,446 [MainThread ] [ERROR] Template file not found: .github/workflows/release-manual-docs.yml
2026-04-04 18:25:03,504 [MainThread ] [ERROR] Template file not found: .github/workflows/release-manual-docs.yml
2026-04-04 18:25:03,524 [MainThread ] [ERROR] Failed to invoke function /usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner. with .github/workflows/release-manual-docs.yml
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 88, in func_wrapper
result = original_func(item)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner.py", line 74, in
results = parallel_runner.run_function(lambda f: (f, self._parse_file(f)), files_to_load)

... [truncated 9283 characters] ...

file .github/workflows/release-manual-docs.yml
2026-04-04 18:25:03,628 [MainThread ] [ERROR] Exception traceback:
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/main.py", line 647, in run
self.scan_reports = runner_registry.run(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/runner_registry.py", line 177, in run
for result in parallel_runner_results:
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 118, in _run_function_multiprocess_fork
raise v.internal_exception.with_traceback(v.internal_exception.traceback)
FileNotFoundError: [Errno 2] No such file or directory: '.github/workflows/release-manual-docs.yml'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}