👷 content vs. votes; permissions

.github/workflows/check-links.yml

@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '0 0 * * 0' # Run every Sunday at midnight
 
+permissions:
+  contents: read
+
 jobs:
   check-links:
     runs-on: ubuntu-latest

.github/workflows/gh-pages.yml

@@ -1,35 +1,34 @@
-name: publish
+name: publish gh-pages
 
 on:
   push:
     branches:
       - 'main'
-  repository_dispatch:
   workflow_dispatch:
-
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
-permissions:
-  contents: write
-  pages: write
-  id-token: write
+  workflow_call:
 
 env:
   GH_BOT_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
   GH_BOT_NAME: "GitHub Action"
   DENO_DIR: .deno-cache
   REPO: commonhaus/commonhaus.github.io
 
-# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
-# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
-concurrency:
-  group: "pages"
-  cancel-in-progress: true
+permissions: {}
 
 jobs:
-  build:
+  publish:
     runs-on: ubuntu-latest
     environment:
       name: github-pages
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
+    # Cancel in-progress runs if a new one is queued
+    concurrency:
+      group: "pages"
+      cancel-in-progress: true
     steps:
       - name: Setup Deno environment
         uses: denoland/setup-deno@v1
@@ -46,36 +45,6 @@ jobs:
           path: ${{ env.DENO_DIR }}
           key: ${{ hashFiles('deno.lock') }}
 
-      - name: Git Config
-        run: |
-          git config user.name ${{ env.GH_BOT_NAME }}
-          git config user.email ${{ env.GH_BOT_EMAIL }}
-
-      - name: Git Submodule Update
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          git pull --recurse-submodules
-          git submodule update --init --remote --recursive
-          deno task lastmod
-
-          if git diff --quiet; then
-            echo "-- No changes -- "
-          else
-            git commit -am "🆙 Auto-update submodule references" && git push
-          fi
-
-      - name: Git Discussion Update
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          deno task activity
-          if git diff --quiet; then
-            echo "-- No changes -- "
-          else
-            git commit -am "💬 Auto-update GH Activity" && git push
-          fi
-
       - name: Build site
         run: deno task build
 

.github/workflows/push-content.yml

@@ -0,0 +1,74 @@
+name: publish
+
+on:
+  push:
+    branches:
+      - 'main'
+  repository_dispatch:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+env:
+  GH_BOT_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
+  GH_BOT_NAME: "GitHub Action"
+  DENO_DIR: .deno-cache
+  REPO: commonhaus/commonhaus.github.io
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    concurrency:
+      group: "push-content"
+      cancel-in-progress: true
+    steps:
+      - name: Setup Deno environment
+        uses: denoland/setup-deno@v1
+        with:
+          deno-version: v1.x
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Cache Deno dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ env.DENO_DIR }}
+          key: ${{ hashFiles('deno.lock') }}
+
+      - name: Git Config
+        run: |
+          git config user.name ${{ env.GH_BOT_NAME }}
+          git config user.email ${{ env.GH_BOT_EMAIL }}
+
+      - name: Git Submodule Update
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git pull --recurse-submodules
+          git submodule update --init --remote --recursive
+          deno task lastmod
+
+          if git diff --quiet; then
+            echo "-- No changes -- "
+          else
+            git commit -am "🆙 Auto-update submodule references" && git push
+          fi
+
+      - name: Git Discussion Update
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          deno task activity
+          if git diff --quiet; then
+            echo "-- No changes -- "
+          else
+            git commit -am "💬 Auto-update GH Activity" && git push
+          fi
+
+  publish-gh-pages:
+    uses: ./.github/workflows/gh-pages.yml
+    secrets: inherit

.github/workflows/push-votes.yml

@@ -0,0 +1,68 @@
+name: push vote results
+
+on:
+  repository_dispatch:
+  workflow_dispatch:
+
+env:
+  GH_BOT_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
+  GH_BOT_NAME: "GitHub Action"
+  DENO_DIR: .deno-cache
+  REPO: commonhaus/commonhaus.github.io
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Setup Deno environment
+        uses: denoland/setup-deno@v1
+        with:
+          deno-version: v1.x
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Cache Deno dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ env.DENO_DIR }}
+          key: ${{ hashFiles('deno.lock') }}
+
+      - name: Git Config
+        run: |
+          git config user.name ${{ env.GH_BOT_NAME }}
+          git config user.email ${{ env.GH_BOT_EMAIL }}
+
+      - name: Git Submodule Update
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git pull --recurse-submodules
+          git submodule update --init --remote --recursive
+          deno task lastmod
+
+          if git diff --quiet; then
+            echo "-- No changes -- "
+          else
+            git commit -am "🆙 Auto-update submodule references" && git push
+          fi
+
+      - name: Git Discussion Update
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          deno task activity
+          if git diff --quiet; then
+            echo "-- No changes -- "
+          else
+            git commit -am "💬 Auto-update GH Activity" && git push
+          fi
+
+  publish-gh-pages:
+    uses: ./.github/workflows/gh-pages.yml
+    secrets: inherit