Skip to content

Restore contents:write permission for docs deploy (fix gh-pages 403)#49

Closed
ChrisRackauckas-Claude wants to merge 1 commit into
SciML:mainfrom
ChrisRackauckas-Claude:restore-docs-deploy-permissions
Closed

Restore contents:write permission for docs deploy (fix gh-pages 403)#49
ChrisRackauckas-Claude wants to merge 1 commit into
SciML:mainfrom
ChrisRackauckas-Claude:restore-docs-deploy-permissions

Conversation

@ChrisRackauckas-Claude

Copy link
Copy Markdown
Collaborator

Problem

The docs-deploy step fails: the documentation build passes, but deploydocs cannot push to gh-pages (403 / GITHUB_TOKEN is read-only).

Root cause

The CI-centralization migration to documentation.yml@v1 dropped the permissions: block from the Documentation.yml caller job. The reusable workflow (SciML/.github/.github/workflows/documentation.yml@v1) declares no permissions: of its own and deploys via GITHUB_TOKEN (Documenter auto-uses GITHUB_TOKEN when DOCUMENTER_KEY is absent). In a reusable-workflow call, the caller job's permissions flow through to the token. With no permissions: block on the caller, the token defaults to read-only and the gh-pages push 403s.

Fix

Add actions: write, contents: write, statuses: write to the build-and-deploy-docs caller job. contents: write is what lets deploydocs push to gh-pages. This mirrors the confirmed fix in OrdinaryDiffEqOperatorSplitting #90.

YAML-only change. Validated with python3 -c "import yaml; yaml.safe_load(...)". Full verification of the deploy requires a CI run on main (deploy only runs on push to main/tags, not on PR), so this cannot be verified end-to-end from the PR; the change is correct by matching the proven #90 pattern.

   build-and-deploy-docs:
     name: "Documentation"
+    permissions:
+      actions: write
+      contents: write
+      statuses: write
     uses: "SciML/.github/.github/workflows/documentation.yml@v1"
     secrets: "inherit"

Please ignore until reviewed by @ChrisRackauckas

The CI-centralization migration to documentation.yml@v1 dropped the
permissions: block from the Documentation.yml caller job. The reusable
workflow declares no permissions of its own, so the caller job's
permissions flow through to the GITHUB_TOKEN. Without contents: write,
Documenter's deploydocs cannot push to gh-pages and fails with a 403.

Add actions: write, contents: write, statuses: write to the caller job,
mirroring the fix in OrdinaryDiffEqOperatorSplitting #90.

Co-Authored-By: Chris Rackauckas <accounts@chrisrackauckas.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@ChrisRackauckas-Claude

Copy link
Copy Markdown
Collaborator Author

Superseded by SciML/.github#102, which sets permissions: contents: write in the centralized documentation.yml reusable itself — so no per-repo permissions block is needed once v1 is retagged. Closing this in favor of the central fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants