ci: split docs workflow into build and publish

.github/workflows/build.yml

@@ -27,7 +27,7 @@ jobs:
     # fork PRs through pull_request_target for approval
     if: >-
       (github.event_name == 'push') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository)
-    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@d31fdc0ba74985a71acbfa1e994fd45e2bbc5fad # v0.0.3-26-gd31fdc0
+    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@77760ad7cdb83fbb157dffa3ba30cc60fe0e141e # v0.0.3-28-g77760ad
     permissions:
       contents: read
       pull-requests: read

.github/workflows/clippy.yml

@@ -23,7 +23,7 @@ on:
 
 jobs:
   bazel-clippy:
-    uses: eclipse-score/cicd-workflows/.github/workflows/static-analysis.yml@d31fdc0ba74985a71acbfa1e994fd45e2bbc5fad # v0.0.3-26-gd31fdc0
+    uses: eclipse-score/cicd-workflows/.github/workflows/static-analysis.yml@77760ad7cdb83fbb157dffa3ba30cc60fe0e141e # v0.0.3-28-g77760ad
     with:
       bazel-targets: "//score/kvs/rust_kvs/... //score/kvs/rust_kvs_tool/..."
       bazel-config: "lint"

.github/workflows/daily.yml

@@ -19,6 +19,7 @@ permissions:
   pull-requests: write
   pages: write
   id-token: write
+  actions: write # prune obsolete GitHub Actions caches
 
 on:
   # Runs every day at midnight UTC
@@ -30,4 +31,4 @@ on:
 
 jobs:
   maintenance:
-    uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@d31fdc0ba74985a71acbfa1e994fd45e2bbc5fad # v0.0.3-26-gd31fdc0
+    uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@77760ad7cdb83fbb157dffa3ba30cc60fe0e141e # v0.0.3-28-g77760ad

.github/workflows/docs-publish.yml

@@ -0,0 +1,31 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+name: Docs Publish
+
+# Privileged publishing of the artifact built by the unprivileged "Documentation CI" workflow.
+on:
+  workflow_run:
+    workflows: ["Docs Build"] # must match the name in docs.yml
+    types: [completed]
+
+jobs:
+  docs-publish:
+    if: github.event.workflow_run.conclusion == 'success'
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs-publish.yml@77760ad7cdb83fbb157dffa3ba30cc60fe0e141e # v0.0.3-28-g77760ad
+    permissions:
+      actions: read
+      contents: write
+      id-token: write
+      pages: write
+      pull-requests: write

.github/workflows/docs.yml

@@ -11,59 +11,34 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 
-name: Documentation
+# The workflow name is referenced by docs-publish.yml (workflow_run); keep both in sync.
+name: Docs Build
 
+# Unprivileged build only. Publishing happens in docs-publish.yml.
 permissions:
-  contents: write
-  pages: write
-  pull-requests: write
-  id-token: write
+  contents: read
 
 on:
   pull_request:
     types: [opened, reopened, synchronize]
-  pull_request_target:
-    types: [opened, reopened, synchronize] # Allows forks to trigger the docs build
   push:
     branches:
       - main
   merge_group:
     types: [checks_requested]
   release:
-    types: [created]
+    types: [published]
 
 jobs:
-  docs-verify:
-    # Run pushes to the main branch, merge groups, releases ||
-    # same-repository PRs without approval ||
-    # fork PRs through pull_request_target for approval
-    if: >-
-      (github.event_name == 'push') || (github.event_name == 'merge_group') || (github.event_name == 'release') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository)
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs-verify.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
-    permissions:
-      pull-requests: write
-      contents: read
-    with:
-      bazel-docs-verify-target: "--lockfile_mode=error //:docs_check"
-
   cit-tests:
-    if: >-
-      (github.event_name == 'push') || (github.event_name == 'merge_group') || (github.event_name == 'release') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository)
     uses: ./.github/workflows/component_integration_tests.yml
-    secrets: inherit
 
-  build-docs:
-    needs: [docs-verify, cit-tests] # Test reports are needed for traceability links
-    # Merge-queue refs may be deleted before this build/deployment starts.
-    if: ${{ always() && needs.docs-verify.result == 'success' && github.event_name != 'merge_group' }}
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@d31fdc0ba74985a71acbfa1e994fd45e2bbc5fad # v0.0.3-26-gd31fdc0
+  docs:
+    needs: [cit-tests] # Test reports are needed for traceability links
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@77760ad7cdb83fbb157dffa3ba30cc60fe0e141e # v0.0.3-28-g77760ad
     permissions:
-      contents: write
-      pages: write
-      pull-requests: write
-      id-token: write
-
+      contents: read
     with:
-      bazel-target: "--lockfile_mode=error //:docs -- --github_user=${{ github.repository_owner }} --github_repo=${{ github.event.repository.name }}"
+      bazel-target: "--lockfile_mode=error //:docs"
       retention-days: 3
       tests-report-artifact: tests-report

.github/workflows/license_check.yml

@@ -33,7 +33,7 @@ jobs:
     # fork PRs through pull_request_target for approval
     if: >-
       (github.event_name == 'merge_group') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository)
-    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@d31fdc0ba74985a71acbfa1e994fd45e2bbc5fad # v0.0.3-26-gd31fdc0
+    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@77760ad7cdb83fbb157dffa3ba30cc60fe0e141e # v0.0.3-28-g77760ad
     with:
       repo-url: "${{ github.server_url }}/${{ github.repository }}"
       bazel-target: "run --lockfile_mode=error //:license-check"

.github/workflows/on-pr.yml

@@ -26,6 +26,6 @@ on:
 
 jobs:
   common:
-    uses: eclipse-score/cicd-workflows/.github/workflows/on-pr.yml@d31fdc0ba74985a71acbfa1e994fd45e2bbc5fad # v0.0.3-26-gd31fdc0
+    uses: eclipse-score/cicd-workflows/.github/workflows/on-pr.yml@77760ad7cdb83fbb157dffa3ba30cc60fe0e141e # v0.0.3-28-g77760ad
     permissions:
       contents: read