github-actions: update

.github/workflows/ci.yml

@@ -11,8 +11,6 @@ jobs:
   bom:
     name: Bill of Materials
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     steps:
       - uses: actions/checkout@v4
       - uses: cachix/install-nix-action@v26
@@ -21,10 +19,25 @@ jobs:
           name: newam
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
       - run: nix build .#bom -L
-      - name: deploy
-        if: ${{ github.ref == 'refs/heads/main' }}
-        uses: peaceiris/actions-gh-pages@v3
+      # https://github.com/actions/upload-pages-artifact?tab=readme-ov-file#file-permissions
+      - name: fix permissions
+        run: |
+          cp -rL result public
+          chmod 777 -R public
+      - uses: actions/upload-pages-artifact@v3
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./result
-          force_orphan: true
+          path: ./public
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: bom
+    if: ${{ github.ref == 'refs/heads/main' }}
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/deploy-pages@v4
+        id: deployment