docs: adding the workflow yaml and the default from docs-template.

[LAShemilt]

Description

Adding a documentation workflow to the frontend repository based on the docs-template repository . This provides unified styling for all documentation across the SciCat project space.

Motivation

We want to put documentation next to the microservices , instead of having a single documentation repository which is hard to maintain. We want the styling and CI of the docs to be consistent across the SciCat Project.

Changes:

• added default mkdocs.yml to .github/mkdocs path
• added publish-docs.yml workflow

Summary by Sourcery

Set up documentation deployment via GitHub Actions and provide a default mkdocs configuration for unified styling.

CI:

• Add publish-docs.yml workflow to deploy documentation on pushes to main and version tags using the docs-template action

Documentation:

• Add default mkdocs.yml in .github/mkdocs inheriting from the shared docs-template configuration

[sourcery-ai]

Hey there - I've reviewed your changes and they look great!

Blocking issues:

• An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location> `.github/workflows/publish-docs.yml:14` </location>
<code_context>
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: SciCatProject/docs-template/.github/actions/mkdocs-pages@main
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
</code_context>

<issue_to_address>
**suggestion (bug_risk):** Consider pinning the action to a specific commit or tag for reproducibility.

Referencing '@main' may introduce breaking changes if the upstream branch changes. Pinning to a commit or tag ensures stable and predictable builds.

Suggested implementation:

```
      - uses: SciCatProject/docs-template/.github/actions/mkdocs-pages@c7e2f3a2b7e8a1d2f4b5c6e7f8a9b0c1d2e3f4a5

```

Replace `c7e2f3a2b7e8a1d2f4b5c6e7f8a9b0c1d2e3f4a5` with the actual commit SHA or tag you want to pin to. You can find the latest stable commit or tag in the SciCatProject/docs-template repository.
</issue_to_address>

### Comment 2
<location> `.github/workflows/publish-docs.yml:14` </location>
<code_context>
      - uses: SciCatProject/docs-template/.github/actions/mkdocs-pages@main
</code_context>

<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

*Source: opengrep*
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

suggestion (bug_risk): Consider pinning the action to a specific commit or tag for reproducibility.

Referencing '@main' may introduce breaking changes if the upstream branch changes. Pinning to a commit or tag ensures stable and predictable builds.

Suggested implementation:

      - uses: SciCatProject/docs-template/.github/actions/mkdocs-pages@c7e2f3a2b7e8a1d2f4b5c6e7f8a9b0c1d2e3f4a5

Replace c7e2f3a2b7e8a1d2f4b5c6e7f8a9b0c1d2e3f4a5 with the actual commit SHA or tag you want to pin to. You can find the latest stable commit or tag in the SciCatProject/docs-template repository.

[sourcery-ai]

security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha): An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

Source: opengrep