update to v4 of tech docs publisher

This fixes the link checker failing due to links to github repos, which
require the user to be logged in.

.github/workflows/check-links.yml

@@ -1,17 +1,39 @@
-name: Check for broken links
-
+name: Build and Test
 on:
-  workflow_dispatch:
   pull_request:
-    paths:
-      - "source/**"
+    branches:
+      - main
 
+permissions: {}
 jobs:
-  check_links:
+  build:
+    name: Build
     runs-on: ubuntu-latest
     container:
-      image: ministryofjustice/tech-docs-github-pages-publisher:v3
+      image: docker.io/ministryofjustice/tech-docs-github-pages-publisher@sha256:cd3513beca3fcaf5dd34cbe81a33b3ff30337d8ada5869b40a6454c21d6f7684 # v4.0.0
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - name: Build
+        id: build
+        run: |
+          /usr/local/bin/package
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-      - name: htmlproofer
-        run: /scripts/check-url-links.sh
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - name: Lychee
+        id: lychee
+        uses: lycheeverse/lychee-action@2b973e86fc7b1f6b36a93795fe2c9c6ae1118621 # v1.10.0
+        with:
+          args: --verbose --no-progress './**/*.md' './**/*.html' './**/*.erb' --exclude-loopback --accept 401,403,200,429 --exclude '^https://github.com/moj-analytical-services/create-a-derived-table'
+          fail: true

.github/workflows/publish.yml

@@ -23,48 +23,44 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      image: ministryofjustice/tech-docs-github-pages-publisher:v3
+      image: docker.io/ministryofjustice/tech-docs-github-pages-publisher@sha256:cd3513beca3fcaf5dd34cbe81a33b3ff30337d8ada5869b40a6454c21d6f7684 # v4.0.0
+    permissions:
+      contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-      - name: Compile Markdown to HTML and create artifact
+        id: checkout
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+
+      - name: Build
+        id: build
         run: |
-          /scripts/deploy.sh
-      - name: Upload artifact to be published
-        uses: actions/upload-artifact@v4
+          /usr/local/bin/package
+
+      - name: Upload Artifact
+        id: upload_artifact
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: github-pages
           path: artifact.tar
           retention-days: 1
+          overwrite: true
 
-  deploy:
+  publish:
     needs: build
+    name: Publish
+    runs-on: ubuntu-latest
     environment:
       name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
+      url: ${{ steps.configure_pages.outputs.base_url }}
+    permissions:
+      contents: read
+      id-token: write
+      pages: write
     steps:
-      - name: Setup Pages
-        uses: actions/configure-pages@v5
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v4
+      - name: Configure Pages
+        id: configure_pages
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
 
-  url-check:
-    needs: deploy
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download a Build Artifact from build
-        uses: actions/[email protected]
-        with:
-          name: github-pages
-          path: github-pages
-      - name: Unpack files and check URL links
-        run: |
-          cd github-pages
-          tar -xvf artifact.tar
-          npm install linkinator
-          npx linkinator . --recurse --markdown \
-            --skip https://ministryofjustice.github.io/find-moj-data-user-guide/images/govuk-large.png \
-            --skip https://github.com/moj-analytical-services/create-a-derived-table \
-          # "URL Check will fail on private and internal GitHub repositories"
+      - name: Deploy to GitHub Pages
+        id: deploy_pages
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5