From a865f9830ca44bbcbbc1a722492d053f01266af7 Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Tue, 14 Jul 2026 08:01:36 +0100
Subject: [PATCH 1/3] ci(pages): restrict deploy-pages workflow to push and
 workflow_dispatch; remove id-token from permissions

---
 .github/workflows/deploy-pages.yml | 38 ++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 .github/workflows/deploy-pages.yml

diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
new file mode 100644
index 00000000..429c9075
--- /dev/null
+++ b/.github/workflows/deploy-pages.yml
@@ -0,0 +1,38 @@
+name: Deploy GitHub Pages
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  pages: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Pages
+        uses: actions/configure-pages@v4
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: '.'
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

From a246ae92305b3bd0dbab4fc1663ebfd155c51143 Mon Sep 17 00:00:00 2001
From: Adrian Adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Thu, 16 Jul 2026 08:44:16 +0100
Subject: [PATCH 2/3] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/deploy-pages.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index 429c9075..29237d96 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -9,6 +9,7 @@ on:
 permissions:
   contents: read
   pages: write
+  id-token: write
 
 concurrency:
   group: pages

From 99be9080916a3ef38a6c44f16bd06041b5e120de Mon Sep 17 00:00:00 2001
From: adrian adewunmi <adrian.a.adewunmi@googlemail.com>
Date: Thu, 16 Jul 2026 08:48:00 +0100
Subject: [PATCH 3/3] ci(pages): remove id-token permission from deploy-pages
 workflow

---
 .github/workflows/deploy-pages.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index 29237d96..429c9075 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -9,7 +9,6 @@ on:
 permissions:
   contents: read
   pages: write
-  id-token: write
 
 concurrency:
   group: pages