fix: remove unnecessary permissions from documentation workflows

Author: ci-sourcerer

.github/workflows/docs.yml

@@ -42,9 +42,6 @@ jobs:
   build:
     name: Build documentation
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pages: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
@@ -107,10 +104,6 @@ jobs:
     if: inputs.deploy_github_pages
     needs: build
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pages: write
-      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

tests/test_docs.py

@@ -36,6 +36,7 @@ def test_reusable_docs_workflow_supports_artifacts_and_github_pages():
     assert "generated_docs_check_task:" in workflow
     assert "actions/upload-artifact@v7" in workflow
     assert "if-no-files-found: error" in workflow
+    assert "permissions:" not in workflow
     assert "cloudflare" not in workflow.lower()
     assert "actions/upload-pages-artifact@v5" in workflow
     assert "actions/deploy-pages@v5" in workflow
@@ -51,7 +52,13 @@ def test_repository_uses_reusable_docs_workflow():
 
     assert "uses: ./.github/workflows/docs.yml" in preview_workflow
     assert "generated_docs_check_task: check-docs-references" in preview_workflow
+    assert "contents: read" in preview_workflow
+    assert "pages: write" not in preview_workflow
+    assert "id-token: write" not in preview_workflow
     assert "uses: ./.github/workflows/docs.yml" in deploy_workflow
     assert "deploy_github_pages: true" in deploy_workflow
     assert "generated_docs_check_task: check-docs-references" in deploy_workflow
+    assert "contents: read" in deploy_workflow
+    assert "pages: write" in deploy_workflow
+    assert "id-token: write" in deploy_workflow
     assert not Path(".github/workflows/docs-preview-cleanup.yml").exists()