From 5995faea4e37479c5ba7e1fcd067cd00591195b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=83=8E=E3=82=A6=E3=83=A9=20=7C=20Flare?=
 <nouraellm@gmail.com>
Date: Sun, 13 Sep 2026 06:23:40 +0200
Subject: [PATCH] fix(ci): pin mkdocs-monorepo-plugin to a commit SHA and split
 Pages deploy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Why

CI and the Dockerfile install `PauloASilva/mkdocs-monorepo-plugin@feat/i18n` (mutable branch) and CI then runs `mkdocs gh-deploy --force` with `contents: write`.

What

- Add `requirements.txt` pinning `mkdocs-material==9.0.9` and the plugin to `63f18e2f87aead69883745a0a4808c275005b0f7`.
- Point `Dockerfile` at that file.
- Split the workflow: `build` (`contents: read`, `mkdocs build`) and `deploy` (`pages: write`, `id-token: write`, `actions/deploy-pages`).
- Pin Actions by SHA.

Maintainer note

`actions/deploy-pages` needs **Settings → Pages → Source = GitHub Actions**. I cannot change that from a fork. Please flip it before or when merging, or the first deploy will fail while the repo is still on branch/`gh-pages`. If `feat/i18n` must move later, bump the SHA in `requirements.txt` in a reviewed commit; do not restore a branch ref.

fixes #168
---
 .github/workflows/ci.yml | 50 ++++++++++++++++++++++++++++++++--------
 Dockerfile               |  7 ++----
 requirements.txt         |  4 ++++
 3 files changed, 46 insertions(+), 15 deletions(-)
 create mode 100644 requirements.txt

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d756529a3..a25d20360 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,25 +1,55 @@
 name: ci
+
 on:
   push:
     branches:
       - master
+  workflow_dispatch:
+
 permissions:
-  contents: write
+  contents: read
+
 jobs:
-  deploy:
+  build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
-          python-version: 3.x
-      - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-      - uses: actions/cache@v3
+          python-version: "3.12"
+
+      - run: echo "cache_id=$(date --utc '+%V')" >> "$GITHUB_ENV"
+
+      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           key: mkdocs-material-${{ env.cache_id }}
           path: .cache
           restore-keys: |
             mkdocs-material-
-      - run: pip install mkdocs-material==9.0.9
-      - run: pip install git+https://github.com/PauloASilva/mkdocs-monorepo-plugin@feat/i18n
-      - run: mkdocs gh-deploy --force
+
+      - name: Install docs dependencies
+        run: pip install -r requirements.txt
+
+      - name: Build site
+        run: mkdocs build --site-dir site
+
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
+        with:
+          path: site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/master'
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 2ae6bdd7a..d3d6a92c2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,4 @@
 FROM squidfunk/mkdocs-material:9.0.9
 
-ENV MKDOCS_MONOREPO_REPO=https://github.com/PauloASilva/mkdocs-monorepo-plugin
-ENV MKDOCS_MONOREPO_BRANCH="feat/i18n"
-
-RUN python -m pip install git+$MKDOCS_MONOREPO_REPO@$MKDOCS_MONOREPO_BRANCH
-RUN python -m pip install pymdown-extensions
+COPY requirements.txt /tmp/requirements.txt
+RUN python -m pip install --no-cache-dir -r /tmp/requirements.txt
\ No newline at end of file
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 000000000..2e60bf668
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,4 @@
+# Docs build. Pin versions / git SHAs; do not install from live branches.
+mkdocs-material==9.0.9
+pymdown-extensions==10.7.1
+mkdocs-monorepo-plugin @ git+https://github.com/PauloASilva/mkdocs-monorepo-plugin@63f18e2f87aead69883745a0a4808c275005b0f7
\ No newline at end of file