feat(ci[docs]) migrate to OIDC authentication

why: Eliminate long-lived IAM credentials in favor of secure OIDC tokens
what:
- Replace jakejarvis/s3-sync-action with aws-actions/configure-aws-credentials
- Add environment: docs for OIDC trust policy
- Add CloudFront invalidation for key paths (index.html, objects.inv, searchindex.js)
- Keep existing Cloudflare cache purge

Author: tony

.github/workflows/docs.yml

@@ -5,9 +5,14 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    environment: docs
     strategy:
       matrix:
         python-version: ['3.14']
@@ -59,17 +64,25 @@ jobs:
         run: |
           pushd docs; make SPHINXBUILD='uv run sphinx-build' html; popd
 
-      - name: Push documentation to S3
-        uses: jakejarvis/[email protected]
+      - name: Configure AWS Credentials
         if: env.PUBLISH == 'true'
+        uses: aws-actions/configure-aws-credentials@v4
         with:
-          args: --follow-symlinks --delete
-        env:
-          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_REGION: 'us-west-1' # optional: defaults to us-east-1
-          SOURCE_DIR: 'docs/_build/html' # optional: defaults to entire repository
+          role-to-assume: ${{ secrets.LIBTMUX_DOCS_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Push documentation to S3
+        if: env.PUBLISH == 'true'
+        run: |
+          aws s3 sync docs/_build/html "s3://${{ secrets.LIBTMUX_DOCS_BUCKET }}" \
+            --delete --follow-symlinks
+
+      - name: Invalidate CloudFront
+        if: env.PUBLISH == 'true'
+        run: |
+          aws cloudfront create-invalidation \
+            --distribution-id "${{ secrets.LIBTMUX_DOCS_DISTRIBUTION }}" \
+            --paths "/index.html" "/objects.inv" "/searchindex.js"
 
       - name: Purge cache on Cloudflare
         if: env.PUBLISH == 'true'