Document harper deploy setup=true provider=github-actions, and how a workflow uses a trust policy

[dawsontoth]

Documents harper deploy setup=true provider=github-actions (HarperFast/harper#3127), the one-command setup for GitHub Actions deploys that HarperFast/create-harper#147's deploy:setup-ci runs. It also makes plain how a workflow uses a trust policy once it exists: nothing names it, and every harper command in the job authenticates through it when four conditions hold.

Depends-on: HarperFast/harper#3127

For the human reviewer

1. Requirement: the "using it in a workflow" section. You asked for it to be easy to see that harper deploy, and any other harper command in a correctly set-up job, authenticates by itself once a policy exists. It is now a subsection of Workload identity listing the four conditions, with a one-job excerpt, and the operations reference and CI guide point at it. It says that authentication is not authorization: what each command may do is the policy's user's role.
2. The CI guide keeps its hand-written, tag-triggered policy. The setup command pins one branch, which a tag-triggered workflow can't match, so the guide only points at the command in a tip for branch-triggered workflows (create-harper's), and says its role lacks the guide's get_deployment.
3. The residual race is documented, not hidden. commands.md says setup re-checks just before writing the policy but a concurrent super user can still have it overwritten, matching the decision in Set up GitHub Actions deploys with harper deploy setup=true provider=github-actions harper#3127.

Changes

• reference/cli/commands.md: a GitHub Actions deploys (OIDC) section for the new provider, covering the repository lookup, the workflow check, the names, create-only, recovery when the variable can't be set, revocation and the branch-pin scope; the setup=true parameter mentions it.
• reference/cli/authentication.md: the one-command setup, and the "Using it in a workflow" subsection.
• reference/operations-api/operations.md: the OIDC section points at both.
• learn/developers/deploying-from-ci.mdx: the same pointer, and the tip.
• release-notes/v5-lincoln/5.4.md: the new setup, badged v5.4.0 like the rest.

Verification

• npm run format:check and npm run build pass.
• Each claim about the setup was checked against bin/deploySetupGithubActions.ts on the Set up GitHub Actions deploys with harper deploy setup=true provider=github-actions harper#3127 branch, which was also run live against a local build (see that PR). The steps were rewritten after the Harper review rounds changed the behavior (the repository is now always looked up; the workflow check refuses a workflow with no environment).
• Cross-model review: Codex, Gemini, Cursor and the Claude domain adjudicator, two rounds ending in a closing full round.

Related PRs: #713 overlaps

Complexity: easy

🤖 Generated with Claude Code

_{Review-Coverage: authored=claude; ran=gemini,cursor-composer,codex,cursor-muse; adjudicated=domain; declined=cursor-grok,cursor-kimi; rounds=2; full=2 @ 3bf4f3d}

_{Review-Attention: skim ~2m (decisions: setup-pins-one-branch, document-race-not-fix, rerun-rewrites-variable) @ 3bf4f3d}

[gemini-code-assist]

Code Review

This pull request updates the documentation across several files to introduce and explain the new GitHub Actions OIDC deployment setup (harper deploy setup=true provider=github-actions) added in version 5.4.0. The review feedback highlights multiple instances where the component is incorrectly used within running prose or mid-sentence, advising the use of plain text instead to maintain consistent formatting.

[github-actions]

🚀 Preview Deployment

Your preview deployment is ready!

🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-722

This preview will update automatically when you push new commits.

[github-actions]

🚀 Preview Deployment

Your preview deployment is ready!

🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-722

This preview will update automatically when you push new commits.