From 0268a06fa3ca64b8377ef16f18d74eefbc0193d4 Mon Sep 17 00:00:00 2001
From: awphi <26072111+awphi@users.noreply.github.com>
Date: Thu, 16 Jul 2026 10:40:22 +0100
Subject: [PATCH 1/3] ci: deploy docs to staging on push to main

Signed-off-by: awphi <26072111+awphi@users.noreply.github.com>
---
 .github/workflows/staging.yaml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 .github/workflows/staging.yaml

diff --git a/.github/workflows/staging.yaml b/.github/workflows/staging.yaml
new file mode 100644
index 00000000..618b44b6
--- /dev/null
+++ b/.github/workflows/staging.yaml
@@ -0,0 +1,31 @@
+name: Deploy to staging
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish-docs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: AWS GitHub OIDC Login
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::529607359382:role/Proj-GHA-topo-docs-s3-upload
+          aws-region: eu-west-1
+
+      - name: Publish docs site
+        uses: ARM-software/docs-action/publish@v0.1.3
+        with:
+          docs-root: docs
+          site-id: topo
+          environment: staging

From 85ab8bd491ebdc4d2e63d479cb49b41b4a24134a Mon Sep 17 00:00:00 2001
From: awphi <26072111+awphi@users.noreply.github.com>
Date: Thu, 16 Jul 2026 10:43:25 +0100
Subject: [PATCH 2/3] pin SHAs

Signed-off-by: awphi <26072111+awphi@users.noreply.github.com>
---
 .github/workflows/staging.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/staging.yaml b/.github/workflows/staging.yaml
index 618b44b6..e11028bd 100644
--- a/.github/workflows/staging.yaml
+++ b/.github/workflows/staging.yaml
@@ -18,13 +18,13 @@ jobs:
         uses: actions/checkout@v7
 
       - name: AWS GitHub OIDC Login
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: arn:aws:iam::529607359382:role/Proj-GHA-topo-docs-s3-upload
           aws-region: eu-west-1
 
       - name: Publish docs site
-        uses: ARM-software/docs-action/publish@v0.1.3
+        uses: ARM-software/docs-action/publish@a9b8ff0e4073c5477d8e3a11a36dec267aa52f7f # v0.1.3
         with:
           docs-root: docs
           site-id: topo

From 6c716f198fbbb02756f43253594720c869e22e24 Mon Sep 17 00:00:00 2001
From: awphi <26072111+awphi@users.noreply.github.com>
Date: Thu, 16 Jul 2026 11:32:36 +0100
Subject: [PATCH 3/3] test deploy

Signed-off-by: awphi <26072111+awphi@users.noreply.github.com>
---
 .github/workflows/staging.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/staging.yaml b/.github/workflows/staging.yaml
index e11028bd..0788f271 100644
--- a/.github/workflows/staging.yaml
+++ b/.github/workflows/staging.yaml
@@ -20,11 +20,11 @@ jobs:
       - name: AWS GitHub OIDC Login
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
-          role-to-assume: arn:aws:iam::529607359382:role/Proj-GHA-topo-docs-s3-upload
+          role-to-assume: arn:aws:iam::529607359382:role/Proj-GHA-topo-s3-upload
           aws-region: eu-west-1
 
       - name: Publish docs site
-        uses: ARM-software/docs-action/publish@a9b8ff0e4073c5477d8e3a11a36dec267aa52f7f # v0.1.3
+        uses: ARM-software/docs-action/publish@v0.1.3
         with:
           docs-root: docs
           site-id: topo