Restore contents:write permission for docs deploy (fix gh-pages 403)#49
Closed
ChrisRackauckas-Claude wants to merge 1 commit into
Closed
Conversation
The CI-centralization migration to documentation.yml@v1 dropped the permissions: block from the Documentation.yml caller job. The reusable workflow declares no permissions of its own, so the caller job's permissions flow through to the GITHUB_TOKEN. Without contents: write, Documenter's deploydocs cannot push to gh-pages and fails with a 403. Add actions: write, contents: write, statuses: write to the caller job, mirroring the fix in OrdinaryDiffEqOperatorSplitting #90. Co-Authored-By: Chris Rackauckas <accounts@chrisrackauckas.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator
Author
|
Superseded by SciML/.github#102, which sets |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
docs-deploystep fails: the documentation build passes, butdeploydocscannot push togh-pages(403 / GITHUB_TOKEN is read-only).Root cause
The CI-centralization migration to
documentation.yml@v1dropped thepermissions:block from theDocumentation.ymlcaller job. The reusable workflow (SciML/.github/.github/workflows/documentation.yml@v1) declares nopermissions:of its own and deploys viaGITHUB_TOKEN(Documenter auto-usesGITHUB_TOKENwhenDOCUMENTER_KEYis absent). In a reusable-workflow call, the caller job's permissions flow through to the token. With nopermissions:block on the caller, the token defaults to read-only and thegh-pagespush 403s.Fix
Add
actions: write,contents: write,statuses: writeto thebuild-and-deploy-docscaller job.contents: writeis what letsdeploydocspush togh-pages. This mirrors the confirmed fix in OrdinaryDiffEqOperatorSplitting #90.YAML-only change. Validated with
python3 -c "import yaml; yaml.safe_load(...)". Full verification of the deploy requires a CI run onmain(deploy only runs on push tomain/tags, not on PR), so this cannot be verified end-to-end from the PR; the change is correct by matching the proven #90 pattern.build-and-deploy-docs: name: "Documentation" + permissions: + actions: write + contents: write + statuses: write uses: "SciML/.github/.github/workflows/documentation.yml@v1" secrets: "inherit"Please ignore until reviewed by @ChrisRackauckas