Skip to content

Prefer GITHUB_TOKEN for documentation deploy - #138

Merged
ChrisRackauckas merged 1 commit into
SciML:masterfrom
ChrisRackauckas-Claude:ci/docs-deploy-github-token
Sep 9, 2026
Merged

ChrisRackauckas merged 1 commit into
SciML:masterfrom
ChrisRackauckas-Claude:ci/docs-deploy-github-token

Conversation

@ChrisRackauckas-Claude

Copy link
Copy Markdown
Member

Stop passing a stale DOCUMENTER_KEY into the reusable documentation workflow.

Documenter deploys over SSH whenever DOCUMENTER_KEY is non-empty. The org-level secret is present but cannot git fetch git@github.com:SciML/<pkg>.git, so jobs that already have contents: write on GITHUB_TOKEN still fail at deploy with:

fatal: Could not read from remote repository.
Error: Git failed to fetch git@github.com:SciML/<pkg>.git
Error: Failed to push

This is the common failure on SciMLWorkshop.jl, MethodOfLines.jl, MathML.jl, FiniteVolumeMethod.jl, DiffEqParamEstim.jl, NBodySimulator.jl, and several others. DiffEqDocs.jl, which only passes GITHUB_TOKEN, deploys successfully.

SSH deploy is now opt-in via use-documenter-key (default false). Checkout uses persist-credentials: false. The job requests contents: write.

Please ignore this PR until it has been reviewed by @ChrisRackauckas.

Verification

  • Compared failing reusable-workflow deploys (SSH) against DiffEqDocs (GITHUB_TOKEN only).
  • YAML parses.
  • I did not cut a v1.x tag; @v1 consumers pick this up when the moving v1 tag is updated after merge.

Links

🤖 Generated with Grok Build 1.0.24 (model: grok-4.6)
Session: 01a08654-45f1-7a53-849c-56a7f1531d56 (local Grok Build session; no public conversation URL)

Passing a stale org-level DOCUMENTER_KEY makes Documenter fetch
git@github.com over SSH and fail with "Could not read from remote
repository", even when GITHUB_TOKEN has contents:write. That is why
docs jobs that use the reusable workflow fail on deploy after the
build itself succeeds (SciMLWorkshop, MethodOfLines, MathML, …).

SSH deploy is now opt-in via use-documenter-key. Checkout no longer
persists credentials, and the job requests contents:write.
Co-Authored-By: Chris Rackauckas <accounts@chrisrackauckas.com>
Co-Authored-By: Grok <noreply@x.ai>
Agent-Harness: Grok Build 1.0.24
Agent-Model: grok-4.6
Agent-Session: 01a08654-45f1-7a53-849c-56a7f1531d56 (local Grok Build session; no public conversation URL)
@ChrisRackauckas
ChrisRackauckas marked this pull request as ready for review September 9, 2026 19:32
@ChrisRackauckas
ChrisRackauckas merged commit 41f457c into SciML:master Sep 9, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants