Documentation: skip deployment when the run has no push credentials - #132
Merged
Merged
Conversation
Documentation jobs fail on pull requests from forks and on every Dependabot-triggered run, *after* the documentation has built successfully. Recent examples: SciML/FindFirstFunctions.jl#114, SciML/ModelingToolkitCourse#70, SciML/DiffEqFlux.jl#1070. ## Cause Documenter's `deploy_folder` treats deployment as possible when either credential is merely non-empty: ```julia token_ok = env_nonempty("GITHUB_TOKEN") key_ok = env_nonempty("DOCUMENTER_KEY") auth_ok = token_ok | key_ok ``` GitHub still injects a `GITHUB_TOKEN` for fork and Dependabot pull requests — it is just read-only — so `auth_ok` is true. Combined with `push_preview = true` (which the SciML docs builds use), Documenter builds the docs, attempts to push the preview to `gh-pages`, and the job dies with: ``` fatal: unable to access '...': The requested URL returned error: 403 ERROR: LoadError: failed process: ... `git push -q upstream HEAD:gh-pages` ``` The documentation itself was fine; only the push failed. The red check is noise, and it trains reviewers to ignore a failing Documentation job. ## Fix Pass the credentials only when the run can actually deploy. When they are empty Documenter reports `Deploying: ✗` and exits 0, so the job still verifies that the documentation builds — which is the only thing an untrusted pull request can verify. Preview deployment is unchanged for same-repository pull requests by a human, and deployment on push/tag/schedule is untouched. Co-Authored-By: Chris Rackauckas <accounts@chrisrackauckas.com> Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FEzNTLFutCmTEAZ3zBg5R
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation jobs fail on pull requests from forks and on every Dependabot-triggered run,
after the documentation has built successfully. Recent examples: SciML/FindFirstFunctions.jl#114,
SciML/ModelingToolkitCourse#70, SciML/DiffEqFlux.jl#1070.
Cause
Documenter's
deploy_foldertreats deployment as possible when either credential is merelynon-empty:
GitHub still injects a
GITHUB_TOKENfor fork and Dependabot pull requests — it is justread-only — so
auth_okis true. Combined withpush_preview = true(which the SciML docsbuilds use), Documenter builds the docs, attempts to push the preview to
gh-pages, and thejob dies with:
The documentation itself was fine; only the push failed. The red check is noise, and it trains
reviewers to ignore a failing Documentation job.
Fix
Pass the credentials only when the run can actually deploy. When they are empty Documenter
reports
Deploying: ✗and exits 0, so the job still verifies that the documentation builds —which is the only thing an untrusted pull request can verify.
Preview deployment is unchanged for same-repository pull requests by a human, and deployment on
push/tag/schedule is untouched.
🤖 Generated with Claude Code
https://claude.ai/code/session_014FEzNTLFutCmTEAZ3zBg5R