From 540c5f092753a69b6464f1d29ea4a78588d055ba Mon Sep 17 00:00:00 2001
From: aeneasr <3372410+aeneasr@users.noreply.github.com>
Date: Thu, 13 Aug 2026 08:34:27 +0200
Subject: [PATCH] fix: isolate CLI docs publication credentials

---
 .github/workflows/docs-cli-next.yml | 129 ++++++++++++++++++++++++++++
 docs/cli-next/action.yml            |  89 ++++++++++++++-----
 newsletter/action.yml               |   2 +-
 releaser/action.yml                 |   2 +-
 4 files changed, 198 insertions(+), 24 deletions(-)
 create mode 100644 .github/workflows/docs-cli-next.yml

diff --git a/.github/workflows/docs-cli-next.yml b/.github/workflows/docs-cli-next.yml
new file mode 100644
index 0000000..8c011a7
--- /dev/null
+++ b/.github/workflows/docs-cli-next.yml
@@ -0,0 +1,129 @@
+name: Build and publish CLI docs
+
+on:
+  workflow_call:
+    inputs:
+      arg:
+        description: Optional single argument passed before the output directory.
+        required: false
+        type: string
+        default: ""
+      docs-branch:
+        description: Branch in ory/docs to update.
+        required: false
+        type: string
+        default: master
+      output-dir:
+        description: Relative directory in ory/docs to replace.
+        required: true
+        type: string
+    secrets:
+      token:
+        description: Token used only to push the generated documentation.
+        required: true
+
+jobs:
+  build:
+    name: Build CLI docs
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version-file: go.mod
+      - name: Generate CLI docs
+        env:
+          CLI_DOC_ARG: ${{ inputs.arg }}
+        run: |
+          set -euo pipefail
+          make .bin/clidoc
+          args=()
+          if [[ -n "$CLI_DOC_ARG" ]]; then
+            args+=("$CLI_DOC_ARG")
+          fi
+          .bin/clidoc "${args[@]}" cli-docs
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: cli-docs
+          path: cli-docs
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    name: Publish CLI docs
+    if: ${{ github.ref_name == 'master' || github.ref_type == 'tag' }}
+    needs: build
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: ory/docs
+          ref: ${{ inputs.docs-branch }}
+          path: docs
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        with:
+          name: cli-docs
+          path: cli-docs
+      - name: Validate generated CLI docs
+        env:
+          OUTPUT_DIR: ${{ inputs.output-dir }}
+        run: |
+          set -euo pipefail
+          if [[ ! "$OUTPUT_DIR" =~ ^[A-Za-z0-9._/-]+$ ]] ||
+            [[ "$OUTPUT_DIR" == /* ]] || [[ "/$OUTPUT_DIR/" == */../* ]]; then
+            echo "output-dir must be a relative path without parent traversal"
+            exit 1
+          fi
+          if find cli-docs -type l | grep -q .; then
+            echo "generated documentation contains symlinks"
+            exit 1
+          fi
+          if find cli-docs -type f ! -name '*.md' | grep -q .; then
+            echo "generated documentation contains non-Markdown files"
+            exit 1
+          fi
+          if [[ -z "$(find cli-docs -type f -name '*.md' -print -quit)" ]]; then
+            echo "generated documentation is empty"
+            exit 1
+          fi
+          rm -rf "docs/$OUTPUT_DIR"
+          mkdir -p "docs/$OUTPUT_DIR"
+          cp -R cli-docs/. "docs/$OUTPUT_DIR/"
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "24"
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 10.34.5
+      - name: Format generated CLI docs
+        env:
+          OUTPUT_DIR: ${{ inputs.output-dir }}
+        working-directory: docs
+        run: pnpm dlx prettier@3.8.2 --write "$OUTPUT_DIR"
+      - name: Push docs
+        working-directory: docs
+        env:
+          DOCS_BRANCH: ${{ inputs.docs-branch }}
+          ORY_BOT_PAT: ${{ secrets.token }}
+        run: |
+          set -euo pipefail
+          if [[ -z "$(git status --porcelain)" ]]; then
+            echo "Nothing to commit"
+            exit 0
+          fi
+          git config --local user.email "60093411+ory-bot@users.noreply.github.com"
+          git config --local user.name "ory-bot"
+          git add -A
+          git stash --include-untracked
+          git pull --rebase origin "$DOCS_BRANCH"
+          git stash pop
+          git add -A
+          git commit -m "autogen(docs): generate cli docs"
+          git push "https://ory-bot:${ORY_BOT_PAT}@github.com/ory/docs.git" "HEAD:$DOCS_BRANCH"
diff --git a/docs/cli-next/action.yml b/docs/cli-next/action.yml
index 439308a..3113e33 100644
--- a/docs/cli-next/action.yml
+++ b/docs/cli-next/action.yml
@@ -20,54 +20,99 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: ory/ci/checkout@master
+    - uses: ory/ci/checkout@b405f7fc6a2f89b8f42d6bf0290c6820472224af # master
       with:
         token: ${{ inputs.token || github.token }}
         path: current-repo
         fetch-depth: 0
-    - uses: actions/setup-go@v4
+        persist-credentials: false
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
       with:
-        go-version: "1.22"
-    - run: |
-        git config --global user.email "60093411+ory-bot@users.noreply.github.com"
-        git config --global user.name "ory-bot"
-      shell: bash
+        go-version-file: current-repo/go.mod
     - run: echo 'GOPATH='"$(go env GOPATH)" >> $GITHUB_ENV
       shell: bash
 
-    - uses: actions/checkout@v2
+    - name: Build CLI docs
+      env:
+        CLI_DOC_ARG: ${{ inputs.arg }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        cd current-repo
+        make .bin/clidoc
+        args=()
+        if [[ -n "$CLI_DOC_ARG" ]]; then
+          args+=("$CLI_DOC_ARG")
+        fi
+        .bin/clidoc "${args[@]}" "$RUNNER_TEMP/cli-docs"
+
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
         repository: ory/docs
         path: docs
         ref: ${{ inputs.docs-branch }}
         fetch-depth: 0
-        token: ${{ inputs.token || github.token  }}
+        persist-credentials: false
 
-    - name: Build and push CLI docs
+    - name: Validate generated CLI docs
+      env:
+        OUTPUT_DIR: ${{ inputs.output-dir }}
       shell: bash
       run: |
-        cd current-repo
-        make .bin/clidoc
-        .bin/clidoc ${{ inputs.arg }} ../docs/${{ inputs.output-dir }}
+        set -euo pipefail
+        if [[ ! "$OUTPUT_DIR" =~ ^[A-Za-z0-9._/-]+$ ]] ||
+          [[ "$OUTPUT_DIR" == /* ]] || [[ "/$OUTPUT_DIR/" == */../* ]]; then
+          echo "output-dir must be a relative path without parent traversal"
+          exit 1
+        fi
+        if find "$RUNNER_TEMP/cli-docs" -type l | grep -q .; then
+          echo "generated documentation contains symlinks"
+          exit 1
+        fi
+        if find "$RUNNER_TEMP/cli-docs" -type f ! -name '*.md' | grep -q .; then
+          echo "generated documentation contains non-Markdown files"
+          exit 1
+        fi
+        if [[ -z "$(find "$RUNNER_TEMP/cli-docs" -type f -name '*.md' -print -quit)" ]]; then
+          echo "generated documentation is empty"
+          exit 1
+        fi
+        rm -rf "docs/$OUTPUT_DIR"
+        mkdir -p "docs/$OUTPUT_DIR"
+        cp -R "$RUNNER_TEMP/cli-docs/." "docs/$OUTPUT_DIR/"
 
-    - uses: ory/ci/prettier@master
+    - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      with:
+        node-version: "24"
+    - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
       with:
-        dir: docs
-        action: write
-        target: ${{ inputs.output-dir }}
+        version: 10.34.5
+    - name: Format generated CLI docs
+      env:
+        OUTPUT_DIR: ${{ inputs.output-dir }}
+      working-directory: docs
+      shell: bash
+      run: pnpm dlx prettier@3.8.2 --write "$OUTPUT_DIR"
 
     - name: Push docs
       if: ${{ github.ref_name == 'master' || github.ref_type == 'tag' }}
+      env:
+        DOCS_BRANCH: ${{ inputs.docs-branch }}
+        ORY_BOT_PAT: ${{ inputs.token }}
       shell: bash
       run: |
+        set -euo pipefail
         cd docs
         if [[ -z "$(git status --porcelain)" ]]; then
           echo "Nothing to commit"
           exit 0
         fi
+        git config --local user.email "60093411+ory-bot@users.noreply.github.com"
+        git config --local user.name "ory-bot"
+        git add -A
+        git stash --include-untracked
+        git pull --rebase origin "$DOCS_BRANCH"
+        git stash pop
         git add -A
-        git stash
-        git pull --rebase origin ${{ inputs.docs-branch }}
-        git stash apply
-        git commit -a -m "autogen(docs): generate cli docs"
-        git push origin ${{ inputs.docs-branch }}
+        git commit -m "autogen(docs): generate cli docs"
+        git push "https://ory-bot:${ORY_BOT_PAT}@github.com/ory/docs.git" "HEAD:$DOCS_BRANCH"
diff --git a/newsletter/action.yml b/newsletter/action.yml
index b953841..5eabb6a 100644
--- a/newsletter/action.yml
+++ b/newsletter/action.yml
@@ -22,7 +22,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: ory/ci/checkout@53206fb2760d6580b0e3fa4e4d7547f5d7a0c109 # master
+    - uses: ory/ci/checkout@b405f7fc6a2f89b8f42d6bf0290c6820472224af # master
     - run: |
         git fetch origin +refs/tags/*:refs/tags/*
       shell: bash
diff --git a/releaser/action.yml b/releaser/action.yml
index b3cf36e..8a7d460 100644
--- a/releaser/action.yml
+++ b/releaser/action.yml
@@ -36,7 +36,7 @@ runs:
         large-packages: true
         docker-images: true
         swap-storage: true
-    - uses: ory/ci/checkout@53206fb2760d6580b0e3fa4e4d7547f5d7a0c109 # master
+    - uses: ory/ci/checkout@b405f7fc6a2f89b8f42d6bf0290c6820472224af # master
       with:
         token: ${{ inputs.token }}
         fetch-depth: 0