Fix GitHub Pages deploy job OIDC permissions

[Copilot]

The build-pages workflow was uploading the Pages artifact successfully, then failing in deploy because actions/deploy-pages@v4 could not obtain an OIDC token. This change scopes the required Pages/OIDC permissions onto the deploy job so deployment can complete reliably.

• Root cause

  • The failing job was the Pages publish step, not the docs build.
  • deploy-pages requires id-token: write in the job that performs the deployment.

• Workflow changes

  • Added explicit job-level permissions to deploy in .github/workflows/gh-pages.yaml:
    • contents: read
    • pages: write
    • id-token: write
  • Kept the build/deploy split intact; only the permission boundary changed.

• Repository hygiene

  • Ignored windIO/version.py, which is generated by setuptools-scm, to avoid committing local build artifacts unrelated to the workflow fix.

• Relevant change

  deploy:
    needs: build
    permissions:
      contents: read
      pages: write
      id-token: write
    steps:
      - name: Deploy to GitHub Pages
        uses: actions/deploy-pages@v4

[ptrbortolotti]

seems legit?

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates repository hygiene and GitHub Pages deployment permissions.

Changes:

• Ignore a generated/derived windIO/version.py file.
• Add explicit permissions to the GitHub Pages deployment job.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
.gitignore	Adds windIO/version.py to ignored files list.
.github/workflows/gh-pages.yaml	Grants contents/pages/id-token permissions needed for Pages deployment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rafmudaf]

The docs workflow change looks good to me. On ignoring version.py, the explanation makes sense, but I'm not familiar with the setuptools-scm workflow. @fzahle may know more.