CI: integration tests with coverage enabled fails on deploy-pages step due to GITHUB_TOKEN permissions error

[RyanGlScott]

As seen in this CI log:

Error: Error message: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable
    at Function.<anonymous> (/home/runner/work/_actions/actions/deploy-pages/v4/node_modules/@actions/core/lib/oidc-utils.js:71:1)
    at Generator.next (<anonymous>)
    at /home/runner/work/_actions/actions/deploy-pages/v4/node_modules/@actions/core/lib/oidc-utils.js:8:1
    at new Promise (<anonymous>)
    at __webpack_modules__.98041.__awaiter (/home/runner/work/_actions/actions/deploy-pages/v4/node_modules/@actions/core/lib/oidc-utils.js:4:1)
    at Function.getIDToken (/home/runner/work/_actions/actions/deploy-pages/v4/node_modules/@actions/core/lib/oidc-utils.js:57:1)
    at Object.<anonymous> (/home/runner/work/_actions/actions/deploy-pages/v4/node_modules/@actions/core/lib/core.js:315:1)
    at Generator.next (<anonymous>)
    at /home/runner/work/_actions/actions/deploy-pages/v4/node_modules/@actions/core/lib/core.js:27:1
    at new Promise (<anonymous>)
Error: Ensure GITHUB_TOKEN has permission "id-token: write".

The documentation for the deploy-pages action suggests explicitly enabling the following permissions for GITHUB_TOKEN, which our CI does not currently do:

    # Grant GITHUB_TOKEN the permissions required to make a Pages deployment
    permissions:
      pages: write      # to deploy to Pages
      id-token: write   # to verify the deployment originates from an appropriate source

I will try this to see if it fixes the issue.

[RyanGlScott]

Never mind, we are already specifying these options:

saw-script/.github/workflows/ci.yml

Lines 546 to 548 in 01f534b

	permissions:
	pages: write
	id-token: write

Back to the drawing board...

[RyanGlScott]

@sauclovian-g points out that the PR where this step fails comes from a fork outside the GaloisInc organization, and the deploy-pages step in CI is missing a github.event.pull_request.head.repo.fork == false && github.repository_owner == 'GaloisInc' check (as is done in a similar deploy-pages–based setup here in cryptol's CI). We should try adding this check to the deploy-pages step in saw-script's CI.