From 18e9bfb0578b84cf399450b6f37b3fa7e74a717c Mon Sep 17 00:00:00 2001
From: Carsten Burgard <cburgard@cern.ch>
Date: Fri, 7 Aug 2026 16:45:46 +0200
Subject: [PATCH 1/3] restrict deployment to main branch

only the main branch should be able to deploy
---
 .github/workflows/docs.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 6744d92..23ceac3 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -37,6 +37,9 @@ jobs:
     # Add a dependency to the build job
     needs: build
 
+    # Deploy only after a push to the main branch.
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+
     # Grant GITHUB_TOKEN the permissions required to make a Pages deployment
     permissions:
       pages: write      # to deploy to Pages

From 2284b644456050da7c82f43b5bf1f4f0c6feecf1 Mon Sep 17 00:00:00 2001
From: Carsten Burgard <cburgard@cern.ch>
Date: Fri, 7 Aug 2026 16:48:40 +0200
Subject: [PATCH 2/3] removed spurious if

---
 .github/workflows/docs.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 23ceac3..37800a2 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -53,9 +53,6 @@ jobs:
     # Specify runner + deployment step
     runs-on: ubuntu-latest
 
-    # Shouldn't run when the PR comes from a fork
-    if: ${{ !github.event.pull_request.head.repo.fork }}
-
     steps:
       - name: Deploy to GitHub Pages
         id: deployment

From 32d85be7c505e8e2357603a22cc134ab8b3bf86d Mon Sep 17 00:00:00 2001
From: Carsten Burgard <cburgard@cern.ch>
Date: Mon, 31 Aug 2026 15:06:02 +0200
Subject: [PATCH 3/3] implemented uwes comment

---
 .github/workflows/docs.yml | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 37800a2..1f68594 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -4,21 +4,36 @@ on:
   pull_request:
     branches:
       - main
-  push:
+  # Use the base repository's permissions for merged PRs, including forks.
+  pull_request_target:
+    types: [closed]
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   build:
+    # Never build an unmerged PR in the privileged pull_request_target context.
+    if: >-
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'pull_request_target' &&
+       github.event.action == 'closed' &&
+       github.event.pull_request.merged == true &&
+       github.event.pull_request.base.ref == 'main')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
         with:
+          # On merge, build the accepted commit rather than the PR head.
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.merge_commit_sha || github.sha }}
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: prefix-dev/setup-pixi@v0.9.2
         with:
@@ -37,8 +52,12 @@ jobs:
     # Add a dependency to the build job
     needs: build
 
-    # Deploy only after a push to the main branch.
-    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+    # Deploy only after a PR has been merged into main.
+    if: >-
+      github.event_name == 'pull_request_target' &&
+      github.event.action == 'closed' &&
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.base.ref == 'main'
 
     # Grant GITHUB_TOKEN the permissions required to make a Pages deployment
     permissions: