Drop DOCS_GENERATOR_ACCESS_TOKEN from docs workflow, downgrade to pull_request

[berfinyuksel]

Summary

Remove DOCS_GENERATOR_ACCESS_TOKEN from the docs workflow and downgrade its trigger from pull_request_target to plain pull_request.

The token was only needed to clone the private docs-generator; since pimcore/workflows-collection-public#135 (merged) vendors sanitized public tooling, no secret is needed: read-only token, no secret-exposure surface. Tracked in pimcore/product-management#1321 (org-wide cleanup, template: pimcore/pimcore#19292).

Changes

• Drop the secrets: DOCS_GENERATOR_ACCESS_TOKEN block.
• pull_request_target → pull_request.
• Fix the stale paths entry .github/workflows/new-docs.yml → docs.yml, so changes to the docs workflow itself trigger a docs run.

Verification

The pattern is live-proven in pimcore/pimcore#19292 — its docs run is green on the exact tokenless @main path. This PR's own docs run (triggered by the fixed paths) verifies this repo.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[pimcore-deployments]

🚫 Issue-link guardrail failed — this PR has been converted to draft.

Every PR must reference a tracking issue in pimcore/platform-version so the change stays traceable.

• No issue in pimcore/platform-version is linked.

Add the link with a keyword in the PR description (not in a comment): https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests

When fixed, press Ready for review to re-run the checks.

[Copilot]

Pull request overview

Verdict: LGTM. This securely migrates documentation checks to pull_request and removes the obsolete secret.

Changes:

• Uses the safer pull_request trigger (.github/workflows/docs.yml:4).
• Corrects workflow path filters (:11, :20).
• Removes the docs-generator token while retaining read-only permissions (:23-30).

Review contract:

• Root cause addressed at the workflow boundary; no other local callers were found.
• No API or backward-compatibility impact.
• Workflow changes self-trigger through the corrected path filter.
• No documentation update is required.
• Remaining risk is limited to the existing mutable @main reference (:28).