ci: use token-exchange-service to publish docs

.github/workflows/publish-docs.yml

@@ -10,13 +10,17 @@ on:
       PUBLISH_DOCS_TOKEN:
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   publish-docs-to-gh-pages:
     name: Publish docs to GitHub Pages
     runs-on: ubuntu-latest
     environment: github-pages
     permissions:
-      contents: write
+      id-token: write
+      contents: read
     steps:
       - name: Ensure `destination_dir` is not empty
         if: ${{ inputs.destination_dir == '' }}
@@ -27,11 +31,16 @@ jobs:
           is-high-risk-environment: true
       - name: Run build script
         run: yarn build:docs
+      - name: Get access token
+        id: get-token
+        uses: MetaMask/github-tools/.github/actions/get-token@v1
+        with:
+          token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }}
+          permissions: |
+            contents: write
       - name: Deploy to `${{ inputs.destination_dir }}` directory of `gh-pages` branch
         uses: peaceiris/actions-gh-pages@de7ea6f8efb354206b205ef54722213d99067935
         with:
-          # This `PUBLISH_DOCS_TOKEN` needs to be manually set per-repository.
-          # Look in the repository settings under "Environments", and set this token in the `github-pages` environment.
-          personal_token: ${{ secrets.PUBLISH_DOCS_TOKEN }}
+          personal_token: ${{ steps.get-token.outputs.token }}
           publish_dir: ./docs
           destination_dir: ${{ inputs.destination_dir }}

.github/workflows/publish-main-docs.yml

@@ -8,7 +8,8 @@ jobs:
   publish-to-gh-pages:
     name: Publish docs to `staging` directory of `gh-pages` branch
     permissions:
-      contents: write
+      contents: read
+      id-token: write
     uses: ./.github/workflows/publish-docs.yml
     with:
       destination_dir: staging

.github/workflows/publish-rc-docs.yml

@@ -19,7 +19,8 @@ jobs:
   publish-to-gh-pages:
     name: Publish docs to `rc-${{ needs.get-release-version.outputs.release-version }}` directory of `gh-pages` branch
     permissions:
-      contents: write
+      contents: read
+      id-token: write
     uses: ./.github/workflows/publish-docs.yml
     needs: get-release-version
     with:

.github/workflows/publish-release.yml

@@ -105,7 +105,8 @@ jobs:
     name: Publish docs to `${{ needs.get-release-version.outputs.RELEASE_VERSION }}` directory of `gh-pages` branch
     needs: get-release-version
     permissions:
-      contents: write
+      contents: read
+      id-token: write
     uses: ./.github/workflows/publish-docs.yml
     with:
       destination_dir: ${{ needs.get-release-version.outputs.RELEASE_VERSION }}
@@ -116,7 +117,8 @@ jobs:
     name: Publish docs to `latest` directory of `gh-pages` branch
     needs: publish-npm
     permissions:
-      contents: write
+      contents: read
+      id-token: write
     uses: ./.github/workflows/publish-docs.yml
     with:
       destination_dir: latest