Skip to content

Fix docs-deploy: add permissions block to Documentation caller job#148

Merged
ChrisRackauckas merged 1 commit into
SciML:masterfrom
ChrisRackauckas-Claude:fix-docs-deploy-permissions
Jun 21, 2026
Merged

Fix docs-deploy: add permissions block to Documentation caller job#148
ChrisRackauckas merged 1 commit into
SciML:masterfrom
ChrisRackauckas-Claude:fix-docs-deploy-permissions

Conversation

@ChrisRackauckas-Claude

Copy link
Copy Markdown
Contributor

Problem

The docs build passes, but the deploydocs push to gh-pages fails (403 / GITHUB_TOKEN cannot push).

Root cause

The CI-centralization migration (centralizing on the SciML reusable documentation.yml@v1) dropped the permissions: block from the .github/workflows/Documentation.yml caller job.

The reusable workflow declares no permissions of its own and deploys via:

GITHUB_TOKEN: ${{ inputs.github-token || secrets.GITHUB_TOKEN }}
DOCUMENTER_KEY: ${{ inputs.documenter-key || secrets.DOCUMENTER_KEY }}

Because the reusable declares no permissions:, the caller job's permissions flow through to the GITHUB_TOKEN. With no block on the caller, the token is read-only, so Documenter's deploydocs cannot push to gh-pages.

Fix

Add a permissions: block to the caller job:

jobs:
  build:
    permissions:
      actions: write
      contents: write
      statuses: write
    uses: "SciML/.github/.github/workflows/documentation.yml@v1"
    secrets: "inherit"

This mirrors the proven fix in SciML/OrdinaryDiffEqOperatorSplitting.jl#90 exactly.

This repo deploys via GITHUB_TOKEN (no DOCUMENTER_KEY required), so contents: write is what enables the gh-pages push. The docs check is not disabled and warnonly is not set.

Verification

  • YAML validated with python3 -c "yaml.safe_load(...)" — parses cleanly; the build.permissions block resolves to {actions: write, contents: write, statuses: write}.
  • The actual gh-pages deploy can only be fully confirmed by a real CI run on master (deploydocs only pushes on push events, not PRs). The change is correct by construction by matching the proven Fix small bugs/inconsistencies in GP #90 pattern.

Please ignore until reviewed by @ChrisRackauckas.

The CI-centralization migration (centralizing on the SciML reusable
`documentation.yml@v1`) dropped the `permissions:` block from the
`.github/workflows/Documentation.yml` caller job. The reusable workflow
declares no permissions of its own and deploys via
`GITHUB_TOKEN: ${{ inputs.github-token || secrets.GITHUB_TOKEN }}`, so
the caller job's permissions flow through to the token. Without the
block the token is read-only and Documenter's `deploydocs` cannot push
to gh-pages (403 / permission denied).

Add `actions: write`, `contents: write`, `statuses: write` to the
caller job, mirroring the proven fix in
SciML/OrdinaryDiffEqOperatorSplitting.jl#90.

Co-Authored-By: Chris Rackauckas <accounts@chrisrackauckas.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@ChrisRackauckas ChrisRackauckas marked this pull request as ready for review June 21, 2026 01:43
@ChrisRackauckas ChrisRackauckas merged commit 407c2d4 into SciML:master Jun 21, 2026
14 checks passed
@ChrisRackauckas-Claude

Copy link
Copy Markdown
Contributor Author

Superseded by SciML/.github#102, which sets permissions: contents: write in the centralized documentation.yml reusable itself — so no per-repo permissions block is needed once v1 is retagged. Closing this in favor of the central fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants