Drop DOCS_GENERATOR_ACCESS_TOKEN from docs workflow, downgrade to pull_request

[berfinyuksel]

Summary

Remove DOCS_GENERATOR_ACCESS_TOKEN from the docs workflow and downgrade its trigger from pull_request_target to plain pull_request.

The token was only needed to clone the private docs-generator; since pimcore/workflows-collection-public#135 (merged) vendors sanitized public tooling, no secret is needed: read-only token, no secret-exposure surface. Tracked in pimcore/product-management#1321 (org-wide cleanup, template: pimcore/pimcore#19292).

Changes

• Drop the secrets: DOCS_GENERATOR_ACCESS_TOKEN block.
• pull_request_target → pull_request.
• Fix the stale paths entry .github/workflows/new-docs.yml → docs.yml, so changes to the docs workflow itself trigger a docs run.

Verification

The pattern is live-proven in pimcore/pimcore#19292 — its docs run is green on the exact tokenless @main path. This PR's own docs run (triggered by the fixed paths) verifies this repo.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Verdict: LGTM

Removes obsolete privileged docs-workflow access after tooling became public.

Changes:

• Uses the safer pull_request trigger (.github/workflows/docs.yml:4).
• Corrects both workflow path filters (:11, :20).
• Removes the now-unneeded secret while retaining read-only permissions (:23-30).

Review contract: The root cause is addressed at the correct caller boundary. All local trigger paths are covered, no API compatibility or documentation concerns apply, and the PR’s successful workflow run provides direct regression verification. The existing mutable @main reference remains the only unverified operational risk.