From 3790a893607bc831e4879e41a50118f0f83822bf Mon Sep 17 00:00:00 2001
From: Nick Nicholas <opoudjis@gmail.com>
Date: Tue, 11 Aug 2026 21:19:15 +1000
Subject: [PATCH] cimas: sync 2026-08-10 wave (3-week drift catch-up +
 standoc-models P3)

Fortnightly cimas sync wave 2026-08-10. 97 of 137 mapped repos have
accumulated drift over 3 weeks since last wave (2026-07-22). Key changes:
standoc-models P3 monorepo entry (metanorma-core#16 / ci#390),
mn-samples-plateau docker.yml unmap (ci#388), ci#375/#376 supersedes
(ci#383/#384/#385), gh-actions/model/Makefile verify-images defensive
check (ci#302/#303).

request-checks: true
---
 .github/workflows/automerge.yml |  7 +++++++
 .github/workflows/docker.yml    | 22 +++++++++++++---------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index beb6304..b4aa16a 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -20,6 +20,13 @@ on:
     types:
       - completed
   status: {}
+
+# Least-privilege: pascalgn/automerge-action merges PRs with GITHUB_TOKEN,
+# which requires contents:write (merge) and pull-requests:write.
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   automerge:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 3dd7d42..2eb8707 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -9,10 +9,10 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  pull-requests: write
+  contents: write
   pages: write
   id-token: write
-  packages: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
@@ -29,15 +29,19 @@ jobs:
         with:
           submodules: true
 
-      - name: Setup Flavor
-        uses: actions-mn/setup-flavors@main
-        with:
-          extra-flavors: ribose
-          github-packages-token: ${{ secrets.METANORMA_CI_PAT_TOKEN }}
-          use-bundler: true
-
       - name: Metanorma generate site
+        id: build-and-publish
         uses: actions-mn/build-and-publish@main
         with:
+          token: ${{ secrets.GITHUB_TOKEN }}
           agree-to-terms: true
           destination: artifact
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        uses: actions-mn/deploy-pages@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}