ci: add doc publishment workflow

[tsurumi-yizhou]

Summary by CodeRabbit

• Chores
  • Improved documentation deployment configuration for enhanced reliability and maintainability.
  • Enabled secret inheritance for the deployment workflow.
  • Switched to repository-scoped deployment credentials and adjusted publishing behavior to target a repository subdirectory and preserve existing files.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Warning

Rate limit exceeded

@16bit-ykiko has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 12 minutes and 13 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📝 Walkthrough

Walkthrough

Update CI workflow deployment: GitHub Pages deploy step switched from GITHUB_TOKEN to PUBLISH_DOCS, targets external repo clice-io/docs with destination_dir and keep_files, and the main workflow enables secret inheritance for the deploy job.

Changes

Cohort / File(s)	Summary
Workflow Deployment Configuration .github/workflows/deploy-docs.yml	Replaced GITHUB_TOKEN with PUBLISH_DOCS, removed branch guard/ref condition, added external_repository: clice-io/docs, set publish_dir relative with destination_dir: clice, and enabled keep_files.
Workflow Invocation / Secrets .github/workflows/main.yml	Enabled secrets: inherit for the job/step that calls ./.github/workflows/deploy-docs.yml, allowing the PUBLISH_DOCS secret to be passed through.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• build: optimize the workflow #331 — Prior changes to the same GitHub Actions deployment workflow (tokens, external_repository, destination_dir, keep_files) and main workflow secret propagation.

Poem

🐰 I hopped through CI, a carrot in paws,
Docs stitched to clice on external laws,
PUBLISH_DOCS jingles, keep_files in tow,
Secrets inherited — watch the pages grow! 🥕📘

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: add doc publishment workflow' directly relates to the main changes: modifying GitHub Actions workflows to configure documentation deployment. However, 'doc publishment' is slightly informal; the standard term is 'publication'.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In @.github/workflows/publish-docs.yml:
- Around line 6-7: The workflow currently grants broad token permissions via the
permissions key set to "contents: write"; change this to the least-privilege
option by replacing or removing that setting—either set "contents: read" or
remove the permissions block entirely—and ensure the publish step uses the
provided secrets.PUBLISH_TOKEN (not GITHUB_TOKEN) so the workflow still has the
push/publish access it needs; update any documentation/comments in the workflow
to note reliance on secrets.PUBLISH_TOKEN.

🧹 Nitpick comments (3)

.github/workflows/publish-docs.yml (3)

17-20: Align Node version with repo source-of-truth (and verify toolchain support).

Pinning Node to 24 could break doc tooling if it doesn’t support that runtime. Prefer node-version-file (e.g., .nvmrc or package.json engines) so CI matches the repo’s declared version.

🔧 Example alignment (adjust path if needed)

       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version-file: '.nvmrc'

---

22-24: Prefer npm ci for reproducible installs (if lockfile exists).

For CI, npm ci is more deterministic and faster when a lockfile is present.

⚙️ Suggested change

       - name: Install dependencies
-        run: npm install
+        run: npm ci
         working-directory: ./docs

---

30-35: Use the correct token input for external repository deploys.

For peaceiris/actions-gh-pages, external repositories typically require personal_token. Passing a PAT via github_token may work, but it’s not the recommended input and could break deploys depending on action expectations.

🔁 Suggested input change

       - name: Deploy to GitHub Pages
         uses: peaceiris/actions-gh-pages@v4
         with:
-          github_token: ${{ secrets.PUBLISH_TOKEN }}
+          personal_token: ${{ secrets.PUBLISH_TOKEN }}
           external_repository: clice-io/docs

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In @.github/workflows/deploy-docs.yml:
- Around line 25-26: The workflow currently passes github_token to
peaceiris/actions-gh-pages which cannot push to an external_repository; change
the action input from github_token to personal_token and ensure you supply a
repository-scoped Personal Access Token secret (e.g., replace the key
github_token: ${{ secrets.PUBLISH_DOCS }} with personal_token: ${{
secrets.PUBLISH_DOCS }} in the peaceiris/actions-gh-pages step) so the action
has write access to the external_repository.

[16bit-ykiko]

See #353