refactor(recipe): improve github actions recipe

[babblebey]

This PR revamps the GitHub Actions recipe page to be more action-oriented, easier to scan, and aligned with current semantic-release security guidance.

Notable Changes

• Reworked the page flow to be execution-first:
  1. Quick start at the top
  2. Clear publishing path selection
  3. Minimal Node workflow users can copy and run
  4. Deeper context and edge cases afterward
• Improved navigation with direct links from quick start to relevant sections.
• Added a practical pitfalls checklist and a release readiness checklist.
• Modernized guidance around publishing/auth:
  1. Prioritizes trusted publishing (OIDC) and npm provenance
  2. Clarifies token behavior and setup expectations
• Updated the commit-during-release guidance:
  1. Recommends GitHub App authentication as the preferred approach
  2. Adds a minimal GitHub App token example
  3. Explicitly discourages PAT usage due to security risk
• Added guidance that the workflow snippet represents a simple/default release flow and points users to the Running semantic-release docs for alternate invocation patterns and non-default setups.

Related Issue

• CI Configuration page & recipes: outdated content, dead links, and dead services #11

Screenshot/Screencast

screen-capture.68.webm

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
semantic-release-docs	Ready	Preview, Comment	May 30, 2026 8:47am

[travi]

not all of these need to be considered blocking, but i think there are some things that could be adjusted before we move this forward

[travi]

one general thought about this file: it feels very node heavy, possibly more than it should be. while publishing npm packages is almost certainly our most common use-case, i feel like it maybe distracts from this being a recipe for github actions in the general sense. the concepts covered here are important, but some also apply to gitlab or circle-ci. i think we should adjust so the doc at least opens with more of an actions focus and maybe then follows into the node focus, making it clear that it is the most common or simplest example of releasing from actions. however, i do wonder if some of the higher-level npm guidance should be elsewhere and linked to from here and just highlighting the specifics of how actions factors in within this context. that way it could also be linked to from the gitlab and circle recipes and have each of those highlight the specific details for their contexts, too.

i dont feel like this needs to block getting this iteration merged, so i'd be ok with thinking through this as a follow up

[babblebey]

I can relate to that thought, I believe this is coming from the "package release" tool lens which makes npm feel most primary, and considering that we have npm packed default.

I'd suggest we go the route of finishing up on the other recipe pages, and examine whether there's something we can extract or so.

[travi]

i'm good with that approach, but might be worth capturing so we remember to revisit

[travi]

a couple more suggestions, but approving so you can decide if they are worth doing before merging or not