fix(ci): Use PUBLISH_PAGES_TOKEN in github-pages environment

.github/workflows/coverage-report.yml

@@ -8,7 +8,6 @@ jobs:
     name: Report
     runs-on: ubuntu-latest
     permissions:
-      contents: write
       pull-requests: write
     steps:
       - name: Checkout
@@ -20,25 +19,13 @@ jobs:
           name: coverage
           path: coverage/
 
-      # On push to main, deploy HTML coverage report to GitHub Pages
-      - name: Deploy coverage to GitHub Pages
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./coverage
-          destination_dir: coverage
-
-      # On PRs, fetch baseline coverage from GitHub Pages
       - name: Fetch baseline coverage from GitHub Pages
-        if: github.event_name == 'pull_request'
         run: |
           mkdir -p coverage-base
           curl -fsSL https://metamask.github.io/ocap-kernel/coverage/coverage-summary.json \
             -o coverage-base/coverage-summary.json || { echo "No baseline coverage found"; exit 1; }
 
       - name: Post coverage report
-        if: github.event_name == 'pull_request'
         uses: davelosert/vitest-coverage-report-action@5b6122e3a819a3be7b27fc961b7faafb3bf00e4d
         with:
           json-summary-path: coverage/coverage-summary.json

.github/workflows/main.yml

@@ -61,12 +61,23 @@ jobs:
   coverage-report:
     name: Coverage report
     needs: lint-build-test
-    if: github.event_name != 'merge_group'
+    if: github.event_name == 'pull_request'
     uses: ./.github/workflows/coverage-report.yml
     permissions:
-      contents: write
       pull-requests: write
 
+  publish-coverage:
+    name: Publish coverage to GitHub Pages
+    needs: lint-build-test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    uses: ./.github/workflows/publish-gh-pages.yml
+    with:
+      publish_dir: ./coverage
+      destination_dir: coverage
+      artifact_name: coverage
+    permissions:
+      contents: write
+
   is-release:
     name: Determine whether this is a release merge commit
     needs: lint-build-test

.github/workflows/publish-gh-pages.yml

@@ -0,0 +1,38 @@
+name: Publish to GitHub Pages
+
+on:
+  workflow_call:
+    inputs:
+      publish_dir:
+        description: 'Directory to publish'
+        required: true
+        type: string
+      destination_dir:
+        description: 'Destination directory on gh-pages branch'
+        required: true
+        type: string
+      artifact_name:
+        description: 'Name of artifact to download'
+        required: true
+        type: string
+
+jobs:
+  publish:
+    name: Publish to GitHub Pages
+    runs-on: ubuntu-latest
+    environment: github-pages
+    permissions:
+      contents: write
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v7
+        with:
+          name: ${{ inputs.artifact_name }}
+          path: ${{ inputs.publish_dir }}
+
+      - name: Deploy to GitHub Pages
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
+        with:
+          personal_token: ${{ secrets.PUBLISH_PAGES_TOKEN }}
+          publish_dir: ${{ inputs.publish_dir }}
+          destination_dir: ${{ inputs.destination_dir }}