Replace PUBLISH_DOCS_TOKEN with Token Exchange Service token

[mcmire]

Currently, to set up docs for a module template–derived repo, you must create a metamaskbot PAT for the repo and set it under PUBLISH_DOCS_TOKEN. However, metamaskbot PATs are deprecated in favor of the Token Exchange Service. This commit updates the docs publishing workflow (and dependent workflows) to make use of the Token Exchange Service.

---

Note

Medium Risk
Changes how production docs reach GitHub Pages; misconfigured Token Exchange policies could block publishes, though the workflow degrades with a clear warning rather than using a stale PAT.

Overview
Docs publishing no longer uses per-repo PUBLISH_DOCS_TOKEN secrets. The reusable publish-docs workflow obtains a short-lived contents: write token via MetaMask’s get-token action and vars.TOKEN_EXCHANGE_URL, then passes it to peaceiris/actions-gh-pages.

Callers (publish-main-docs, publish-rc-docs, publish-release, and main) drop the PUBLISH_DOCS_TOKEN secret wiring and add id-token: write where they invoke docs publish. Checkout, build, and deploy run only when token exchange succeeds; if it fails (continue-on-error), the job emits a workflow warning about registering a Token Exchange policy instead of failing opaquely.

^{Reviewed by Cursor Bugbot for commit abf614e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mcmire]

I haven't added a policy for this repo, so with this change, the docs publishing workflow will no longer work. I'm okay with this considering this repo is just a template, but I can add it if we feel that seeing an X when viewing history for this repo would be confusing. Or maybe we can add a conditional around this workflow so that it doesn't run for template repos?

[Mrtenz]

Should we make it exit with code 0 if it fails to get a token?

[mcmire]

If the get-token action fails, wouldn't it cause the workflow to fail too?

[Mrtenz]

Yeah, that's why I'm suggesting we add an exit 0 step if the get-token step failed 😅

[mcmire]

Ah sorry I misread your comment 😅

Yeah, that makes sense. I forgot that sometimes teams don't want to publish docs for their library, and if that's the case they shouldn't be penalized for it.

What do you think about something like this? 63173fb

[Mrtenz]

Looks good!

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 63173fb. Configure here.}