ci: Harden workflows (#925)

* CI: Address zizmor warnings and bump deps

* ci: Switch to our own run-prek action

* ci: Quote env var in deploy workflow

* ci: Change extention from yml to yaml

* ci: Add document start to workflows

* ci: Unify quotes in workflows

* ci: Don't fetch submodules anymore

* ci: Add blank lines and step names

* ci: Trigger ui/build workflows on workflow changes

* fix: correct deploy workflow link and stop build.yaml ignoring itself

---------

Co-authored-by: Techassi <git@techassi.dev>
Co-authored-by: dervoeti <lukas.krug@stackable.tech>

Author: 3 people

.github/workflows/build.yaml

@@ -0,0 +1,33 @@
+---
+name: Build site
+
+on:
+  pull_request:
+    paths-ignore:
+      - .github/PULL_REQUEST_TEMPLATES/**
+      - .github/ISSUE_TEMPLATES/**
+      - scripts/**
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "20"
+          cache: npm
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Build documentation site
+        run: make ANTORAFLAGS=--fetch build-local

.github/workflows/build.yml

@@ -1,3 +1,4 @@
+---
 name: Build and deploy production site
 
 # This job simply calls a trigger hook in netlify.
@@ -7,14 +8,16 @@ name: Build and deploy production site
 on:
   schedule:
     # Monday to Friday, 2:15 in the night
-    - cron: '15 2 * * 1-5'
+    - cron: "15 2 * * 1-5"
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - name: Call Netlify build hook
         env:
           HOOK_URL: ${{ secrets.NETLIFY_BUILD_TRIGGER_HOOK }}
-        run: curl -X POST -d '{}' $HOOK_URL
+        run: curl -X POST -d '{}' "$HOOK_URL"

.github/workflows/deploy.yml .github/workflows/deploy.yaml.github/workflows/deploy.yml renamed to .github/workflows/deploy.yaml

@@ -0,0 +1,20 @@
+---
+name: prek
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  prek:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: stackabletech/actions/run-prek@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0

.github/workflows/pr_pre-commit.yml

@@ -0,0 +1,35 @@
+---
+name: UI lint and bundle
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/ui.yaml"
+      - "ui/**"
+      - "package-lock.json"
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+          cache: npm
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Lint the UI project
+        run: npm run lint --workspace ui
+
+      - name: Bundle the UI project
+        run: npm run bundle --workspace ui

.github/workflows/pr_prek.yaml

@@ -19,4 +19,4 @@ The documentation uses https://trunkbaseddevelopment.com/[trunk based developmen
   That's it, you're done!
 
 The changes will become visible in the online documentation once the next build is triggered.
-You can either wait for the nightly build, or trigger a build yourself with the https://github.com/stackabletech/documentation/actions/workflows/deploy.yml[Build and deploy production site{external-link-icon}^] GitHub action.
+You can either wait for the nightly build, or trigger a build yourself with the https://github.com/stackabletech/documentation/actions/workflows/deploy.yaml[Build and deploy production site{external-link-icon}^] GitHub action.