We can't update it directly from PRs because external PRs are run in
an untrusted context without secrets access. Instead, as suggested by
[this article], we build the site in an untrusted workflow and then
push it in a trusted workflow that has no access to the PR contents
itself.
[this article]: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/,
