From 27c6d8213afa10b8b7a3512cab7881aca7405a48 Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Wed, 8 Jul 2026 07:49:44 +1000 Subject: [PATCH] Add actions: read for the cache artifact download MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The explicit permissions block set all unlisted scopes to none, so the dawidd6/action-download-artifact step (which reads the build cache from cache.yml via the Actions API) had no actions:read. The last publish still succeeded, but the scope is the documented requirement and matches the permissions example in QuantEcon/meta#282 — add it to guarantee the cache download and keep this in sync with lecture-jax. Ports the fix from QuantEcon/lecture-jax#331 (Copilot review follow-up). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/publish.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d63b8fe..c664def 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,6 +7,7 @@ on: # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages permissions: contents: write # write: upload release assets (html archive, checksum, manifest) + actions: read # dawidd6/action-download-artifact reads the cache.yml build artifact pages: write id-token: write # required for OIDC-based Pages deployment