What's the recommended way to use gh-pages?

[dthaler]

Our current project uses job level 'contents' permission set to 'write' in order to push doxygen-generated documentation to the gh-pages branch whenever a PR is merged in the default (main) branch. The scorecard sees this as a High severity TokenPermissionsID issue. The Remediation details just say to use read-only permissions.

So: what's the recommended way to use doxygen-generated gh-pages documentation?

[laurentsimon]

is this related to #1867? Are you using a GitHub action to push your documentation?

[dthaler]

is this related to #1867? Are you using a GitHub action to push your documentation?

Yes. Currently have https://github.com/microsoft/ebpf-for-windows/blob/main/.github/workflows/update-docs.yml but looking to see if there's a better way.

[laurentsimon]

Unfortunately I'm not aware of a better way, unless GH provides a different permission like documentation: write. I think we need to amend the permission check to be aware of the GH action you are using