fix github pages deployment workflow (NomicFoundation#780)

Broken by an additional validation rule that seems to be added recently:
https://github.com/NomicFoundation/slang/actions/runs/7774470067

.github/workflows/_jobs_github_pages.yml

@@ -1,21 +1,13 @@
 name: "jobs/github-pages"
 
-permissions:
-  pages: "write" # to deploy to Pages
-  id-token: "write" # to verify the deployment originates from an appropriate source
-
 on:
   # Run when invoked from other workflows:
   workflow_call: {}
 
 jobs:
-  run:
+  prepare:
     runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
 
-    environment:
-      name: "github-pages"
-      url: "${{ steps.deployment.outputs.page_url }}"
-
     steps:
       #
       # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
@@ -53,6 +45,19 @@ jobs:
         with:
           path: "documentation/target/site" # _SLANG_MKDOCS_DOCUMENTATION_SITE_DIR_ (keep in sync)
 
+  deploy:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+    needs: "prepare"
+
+    permissions:
+      pages: "write" # to deploy to Pages
+      id-token: "write" # to verify the deployment originates from an appropriate source
+
+    steps:
       - name: "Deploy to GitHub Pages"
         id: "deployment"
         uses: "actions/deploy-pages@87c3283f01cd6fe19a0ab93a23b2f6fcba5a8e42"
+
+    environment:
+      name: "github-pages"
+      url: "${{ steps.deployment.outputs.page_url }}"

.github/workflows/_jobs_publish.yml

@@ -1,9 +1,5 @@
 name: "jobs/publish"
 
-permissions:
-  contents: "write" # to create new branches and releases
-  pull-requests: "write" # to create new pull requests for changesets
-
 on:
   # Run when invoked from other workflows:
   workflow_call: {}
@@ -12,6 +8,10 @@ jobs:
   changesets:
     runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
 
+    permissions:
+      contents: "write" # to create new branches and releases
+      pull-requests: "write" # to create new pull requests for changesets
+
     steps:
       #
       # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)

.github/workflows/deploy.yml

@@ -21,12 +21,20 @@ jobs:
     uses: "./.github/workflows/_jobs_ci.yml"
 
   github-pages:
-    needs: "ci"
-    if: "${{ github.repository == 'NomicFoundation/slang' }}"
     uses: "./.github/workflows/_jobs_github_pages.yml"
+    if: "${{ github.repository == 'NomicFoundation/slang' }}" # skip running in forks
+    needs: "ci"
+
+    permissions:
+      pages: "write" # to deploy to Pages
+      id-token: "write" # to verify the deployment originates from an appropriate source
 
   publish:
-    needs: "ci"
-    if: "${{ github.repository == 'NomicFoundation/slang' }}"
     uses: "./.github/workflows/_jobs_publish.yml"
+    if: "${{ github.repository == 'NomicFoundation/slang' }}" # skip running in forks
+    needs: "ci"
+
     secrets: "inherit"
+    permissions:
+      contents: "write" # to create new branches and releases
+      pull-requests: "write" # to create new pull requests for changesets