ci: move workflows off the departed maintainer's personal token - #43
Merged
Conversation
build_docs (docs deploy) authenticated with secrets.GH_TOKEN — a personal token that died when its owner left IHME — so mkdocs gh-deploy failed on every merge. Switch all workflows to the built-in GITHUB_TOKEN with explicit least-privilege permissions: - build_docs: drop the checkout token, add contents:write so gh-deploy can push gh-pages; fix a malformed job `if:` expression. - dependencies: GITHUB_TOKEN + contents/pull-requests write. Its auto PR still opens but no longer triggers CI (re-run manually). - cookiecutter: GITHUB_TOKEN + permissions, drop the daily schedule, and document that template-sync is retired (GITHUB_TOKEN can't edit workflows); revival recipe + tracking in CLIMATE-24. Verified locally: YAML parses, pre-commit/kacl clean. The docs-deploy fix is only exercisable on GitHub (no local harness) — to be confirmed via a workflow_dispatch build_docs run after merge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced Jul 21, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What: Move all CI workflows off
secrets.GH_TOKEN(a personal token owned by a maintainer who left IHME) to the built-inGITHUB_TOKEN, with explicit least-privilegepermissions:.Why:
build_docs's "Deploy docs" step (mkdocs gh-deploy) fails on every merge because the dead personal token can't pushgh-pages. The same token also gateddependencies.ymlandcookiecutter.yml.Changes
build_docs.yml: drop the checkouttoken:, addpermissions: contents: write; fix a malformed jobif:(}} or {{→ single||).alternative_workflows/build_docs.yml: same swap (inert — not under.github/workflows/; consistency only).dependencies.yml: →GITHUB_TOKEN+ permissions. Monthly auto PR still opens but won't auto-trigger CI (re-run manually).cookiecutter.yml: →GITHUB_TOKEN+ permissions; dailyschedule:removed; template-sync retired (GITHUB_TOKENcan't open workflow-editing PRs) with a revival recipe in a top-of-file comment.Consequences (accepted): docs deploy fixed; dependency auto-PRs lose auto-CI; cookiecutter template-sync retired — revival tracked in CLIMATE-24 (needs a non-personal org/App token).
Verification: local YAML parse +
pre-commit/kaclclean; CIactionlintvalidates the fixedif:. Docs deploy is only exercisable on GitHub — will confirm via aworkflow_dispatchbuild_docsrun after merge.Supersedes #36 (its token-swap intent; #36's stale src edits are already on
mainvia #41/#42). Relates to #31.🤖 Generated with Claude Code