Address all 15 outstanding Dependabot alerts.

.github/workflows/docusaurus-gh-pages.yml

@@ -2,6 +2,9 @@ on:
   # Runs on pushes targeting the default branch
   push:
     branches: ["main"]
+  # Build (but do not deploy) pull requests, so changes are verified before merge
+  pull_request:
+    branches: ["main"]
 
 # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
 permissions:
@@ -11,9 +14,10 @@ permissions:
 
 # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
 # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
+# Pull request builds are grouped per-ref instead, where superseding a run is safe.
 concurrency:
-  group: "pages"
-  cancel-in-progress: false
+  group: ${{ github.event_name == 'push' && 'pages' || format('pr-{0}', github.ref) }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build:
@@ -24,8 +28,6 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v7
-      with:
-        repository: psappdeploytoolkit/website
     - name: Install pnpm
       uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
       with:
@@ -38,18 +40,21 @@ jobs:
     - name: Install dependencies
       run: pnpm install
     - name: Setup Pages
+      if: github.event_name == 'push'
       uses: actions/configure-pages@v6
     - name: Run Prettier on Markdown files
       run: pnpm prettier-docs
     - name: Run Docusaurus Build
       run: pnpm build
     - name: Upload artifact
+      if: github.event_name == 'push'
       uses: actions/upload-pages-artifact@v5
       with:
         path: build
 
-  # Deployment job
+  # Deployment job - pushes to main only, never for pull requests
   deploy:
+    if: github.event_name == 'push'
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}