🐛 fix workflow vulnerability #79

.github/workflows/upload_docs.yml

@@ -0,0 +1,33 @@
+name: Upload API Doc
+
+on:
+  workflow_run:
+    workflows: ["Build API Doc"]
+    types:
+      - completed
+
+jobs:
+  upload:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' }}
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          token: ${{ secrets.GH_TOKEN }}
+
+      - uses: dawidd6/action-download-artifact@v2
+        with:
+          workflow: ${{ github.event.workflow_run.workflow_id }}
+          name: docs
+          path: docs/
+
+      - env:
+          REF: ${{ github.event.workflow_run.head_branch }}
+        run: |
+            git config user.name GitHub
+            git config user.email noreply@github.com
+            git add .
+            git diff-index --quiet HEAD || git commit -m ":memo: update api docs"
+            git remote add target "https://github.com/${{ github.event.workflow_run.head_repository.full_name }}.git"
+            git push target HEAD:$REF