deploy only on releases

Author: ocefpaf

.github/workflows/deploy-docs.yml

@@ -1,32 +1,41 @@
 name: Build and Deploy docs
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
-    branches: [main]
-  workflow_dispatch:
+    branches:
+      - main
+  release:
+    types:
+      - published
 
 jobs:
   build-docs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.x"
 
-
       - name: Build documentation
         run: >
           set -e
           && pip install jupyter-book
           && jupyter-book build jupyterbook
 
       - name: GitHub Pages action
-        if: github.ref == 'refs/heads/main'
+        if: success() && github.event_name == 'release'
         uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}