Document private-to-public publishing

[ryanlovett]

There’s a working test site, but we should document it.

• private repo: https://github.com/ryanlovett/stat555-spring-2024/
• workflow in private repo: https://github.com/ryanlovett/stat555-spring-2024/blob/main/.github/workflows/publish-to-public-repo.yml
• public repo: https://github.com/berkeley-stat555/spring-2024-public
• public website:https://stat555.stat.berkeley.edu/spring-2024-public/

Secret token

Enable tokens to be affiliated with github orgs

In class org repo Settings > Third-party Access > Personal access tokens

1. Allow access via fine-grained personal access tokens > Continue
2. Require approval of fine-grained personal access tokens
3. Require administrator approval > Continue
4. Restrict access via personal access tokens:
5. Allow access via personal access tokens (classic) > Continue
6. Review and click "Enroll" > click Continue

Create token affiliated with github org

Under https://github.com/settings/tokens?type=beta

Personal access tokens > Fine-grained tokens > Generate new token

• Token name: stat555-private-to-public
• Expiration: 30 days
• Description: Enable stat555 private repo to push to public repo
• Resource owner: berkeley-stat555
• Repository access: Only select repositories: berkeley-stat555/spring-2024-public
• Repository permissions: Contents > "Access: Read and write"

Generate token, and save it.

Add token as an Action secret in the private repo

1. In private repo > Settings > Secrets and variables > Actions
2. Click New repository secret
3. Create variable MY_GITHUB_ACTIONS_TOKEN, or whatever the variable is named in workflow file.
4. Paste in the contents of the token.

[ryanlovett]

@paciorek Where to keep this documentation? In both -quarto and -myst template READMEs via copy/paste? Or should we have a document that applies to both templates.

Also, should we preserve the tokens in institutional secret storage, or is it fine to just copy/paste for initial setup and regenerate if ever necessary?

[paciorek]

Arggh - I'd like to avoid having additional locations users have to visit. Perhaps we document in -quarto and then have a stub in -myst that links the section of the README in -quarto?

I don't have much opinion about the tokens. Perhaps just regenerate as needed.

[ryanlovett]

What if we create a new quarto repository at berkeley-scf/course-website-instructions, or some such, and put all documentation (quarto, myst, common) there. The READMEs of the -quarto and -myst repos could then just link to that website. There would be less material in the READMEs that they'd have to replace, and there would be only one location (instead of stat999-quarto, stat999-myst, and all of the forks).