Skip to content

documentation.yml: set permissions (contents: write) in the reusable (fix docs-deploy at the source)#102

Merged
ChrisRackauckas merged 1 commit into
SciML:masterfrom
ChrisRackauckas-Claude:docs-deploy-permissions-central
Jun 21, 2026
Merged

documentation.yml: set permissions (contents: write) in the reusable (fix docs-deploy at the source)#102
ChrisRackauckas merged 1 commit into
SciML:masterfrom
ChrisRackauckas-Claude:docs-deploy-permissions-central

Conversation

@ChrisRackauckas-Claude

Copy link
Copy Markdown

Per @ChrisRackauckas: fix the docs-deploy gh-pages 403 centrally instead of per-repo.

The reusable documentation.yml deploys via GITHUB_TOKEN (when no DOCUMENTER_KEY), which needs contents: write. It declared no permissions:, so each consumer's caller job had to grant write — and the CI-centralization migration dropped those per-repo blocks, 403'ing gh-pages across many repos (CatalystNetworkAnalysis, ColPrac, Evolutionary, PDEBase, SparseColumnPivotedQR, OrdinaryDiffEqOperatorSplitting, …).

This adds a workflow-level permissions: {contents: write, actions: write, statuses: write} to the reusable, so all consumers get it without per-repo blocks. Mirrors the grant that the per-caller fix (OrdinaryDiffEqOperatorSplitting #90, verified → Documentation green) used — just moved to the source.

Needs a v1 retag to take effect. Once retagged, the ~6 per-repo permissions-block PRs I opened can be closed as superseded.

⚠️ Caveat: GitHub gates a reusable's token by the caller — this works as long as the consumer caller doesn't restrict permissions (SciML callers don't) and the org token max allows write (it does — #90's explicit grant succeeded). If any repo's org/caller hard-caps to read-only, that repo would still need its own block or the org Workflow-permissions setting.

Please ignore until reviewed by @ChrisRackauckas.

…so consumers don't each need it

The reusable docs workflow deploys to gh-pages via GITHUB_TOKEN (when no
DOCUMENTER_KEY), which requires `contents: write`. It declared no permissions,
so every consumer's caller job had to grant write itself — and the CI
centralization migration dropped those per-repo blocks, 403'ing the gh-pages
push across many repos. Setting the permissions here fixes all consumers at the
source (no per-repo permissions blocks needed) once v1 is retagged.

Co-Authored-By: Chris Rackauckas <accounts@chrisrackauckas.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@ChrisRackauckas ChrisRackauckas merged commit 7561bb4 into SciML:master Jun 21, 2026
2 checks passed
ChrisRackauckas-Claude pushed a commit to ChrisRackauckas-Claude/ColPrac that referenced this pull request Jun 21, 2026
The centralized documentation.yml reusable now sets permissions:
contents:write (SciML/.github#102), so this repo's caller no longer needs
its own permissions block. Merge ONLY after #102 is merged and v1 is
retagged (otherwise the gh-pages deploy 403s again in the gap).

Co-Authored-By: Chris Rackauckas <accounts@chrisrackauckas.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ChrisRackauckas-Claude pushed a commit to ChrisRackauckas-Claude/Evolutionary.jl that referenced this pull request Jun 21, 2026
The centralized documentation.yml reusable now sets permissions:
contents:write (SciML/.github#102), so this repo's caller no longer needs
its own permissions block. Merge ONLY after SciML#102 is merged and v1 is
retagged (otherwise the gh-pages deploy 403s again in the gap).

Co-Authored-By: Chris Rackauckas <accounts@chrisrackauckas.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ChrisRackauckas added a commit to SciML/ColPrac that referenced this pull request Jun 21, 2026
…) (#53)

The centralized documentation.yml reusable now sets permissions:
contents:write (SciML/.github#102), so this repo's caller no longer needs
its own permissions block. Merge ONLY after #102 is merged and v1 is
retagged (otherwise the gh-pages deploy 403s again in the gap).

Co-authored-by: ChrisRackauckas-Claude <accounts@chrisrackauckas.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ChrisRackauckas added a commit to SciML/Evolutionary.jl that referenced this pull request Jun 21, 2026
…) (#149)

The centralized documentation.yml reusable now sets permissions:
contents:write (SciML/.github#102), so this repo's caller no longer needs
its own permissions block. Merge ONLY after #102 is merged and v1 is
retagged (otherwise the gh-pages deploy 403s again in the gap).

Co-authored-by: ChrisRackauckas-Claude <accounts@chrisrackauckas.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ChrisRackauckas-Claude pushed a commit to ChrisRackauckas-Claude/OrdinaryDiffEqOperatorSplitting.jl that referenced this pull request Jun 21, 2026
…by .github#102)

The per-repo Documentation.yml permissions block this PR added is superseded by
SciML/.github#102 (which sets it in the reusable). Drop it here and keep only the
real remaining fix: the `disptach`->`dispatch` typo in src/integrator.jl that the
Spell Check still flags on master.

Co-Authored-By: Chris Rackauckas <accounts@chrisrackauckas.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants