[hamidfzm]

Summary

Keeps write tokens out of jobs that download packages, and pins every third-party action to a commit, as hamidfzm/glyph's CI rules require.

Changes

• Validate is split in two.

  • The old job ran npx --yes ajv-cli@5, which downloads ajv-cli and its dependencies and runs them. It did so with a contents: write token saved in .git/config by the checkout, and pushed with that token afterwards.
  • Now validate has read-only access and keeps every check it had.
  • A new publish-index job, on pushes to main only, regenerates the index with this repo's own scripts and pushes. Those scripts use only Node's standard library, so no downloaded package ever sits next to the token.
  • ajv-cli is pinned to 5.0.0.

• Release plugins runs only this repo's scripts. Its checkout no longer saves the token. The push passes it through env, as hamidfzm/glyph's dependency sync does.

• Docs site is split into build, read-only, which runs the export, and deploy, the only job that can publish to Pages.

  • It keeps glyph-md/export-website-action@v1 on purpose: the rolling tag renders the docs with the newest Glyph release.

• Smoke gets read-only permissions.

• Pinned actions (and off Node 20):

  • actions/checkout v6.1.0;
  • actions/upload-pages-artifact v5.0.0;
  • actions/deploy-pages v5.0.1.

  These are the same SHAs hamidfzm/glyph uses. The old upload-pages-artifact v4 and deploy-pages v4 run on Node 20.

• Dependabot keeps the pins current: weekly, a 7-day cooldown, and no major versions.

Testing

• This PR's checks run Validate and Smoke. publish-index is skipped on a PR, by design.
• The docs site, release and publish-index jobs run after the merge. Their first runs are the proof; I'll check them.