CI: Protect manual package publishing workflows

[r-farkhutdinov]

No description provided.

[Copilot]

Pull request overview

This PR hardens CI/CD workflows related to manual publishing and deployments by tightening default GITHUB_TOKEN permissions and introducing environment-based approval gates for higher-impact actions (package publishing, storybook cleanup, GitHub Pages demos deploy). It also refactors the packages publishing scheduler to call a reusable workflow instead of invoking gh workflow run.

Changes:

• Restricts workflow-level permissions to read by default and elevates to write only for the specific deploy/publish jobs that need it.
• Adds environment-based approval jobs for manual package publishing and manual storybook cleanup/scheduler runs.
• Converts packages_publishing_scheduler.yml to reuse packages_publishing.yml via workflow_call, passing inputs for tag/branch/filter.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/publish-demos.yml	Adds minimal default permissions and an environment + write permissions for the gh-pages deploy job.
.github/workflows/pr-storybook-deploy.yml	Associates the “remove storybook” job with the storybook environment and a preview URL.
.github/workflows/pr-storybook-cleanup.yml	Adds an approval-gated path for manual cleanup runs while keeping scheduled cleanup functional.
.github/workflows/packages_publishing.yml	Adds reusable workflow inputs, default permissions, approval gating, and branch-aware checkouts for build/publish.
.github/workflows/packages_publishing_scheduler.yml	Adds permission scoping + manual approval gate, and switches to calling the reusable publishing workflow directly.

Suppressed comments (1)

.github/workflows/pr-storybook-cleanup.yml:30

• actions/checkout@v6 is not a published major version of the official actions/checkout action (current major is v4). With this pin, the cleanup workflow will fail when checking out gh-pages.

Please switch to an existing major (e.g. @v4).

    if: ${{ always() && !cancelled() && (github.event_name != 'workflow_dispatch' || needs.approve-manual-cleanup.result == 'success') }}

    steps:
      - name: Checkout gh-pages (full history)
        uses: actions/checkout@v6