From cc913617c48fb2b5533d3e1a81daf2d3b4e5905c Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Tue, 7 Jul 2026 16:02:16 +1000 Subject: [PATCH 1/2] INFR: Migrate GitHub Pages deploy to artifact-based workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the peaceiris/actions-gh-pages deploy with native, artifact-based GitHub Pages deployment via quantecon/actions/publish-gh-pages, matching the family reference (lecture-dp). This removes the gh-pages branch dependency so the branch can be deleted, keeping the repo small. The GPU build stays a single job (per the migration guide, GPU repos avoid the two-job build+deploy pattern to skip large artifact transfers). The manual HTML archive / checksum / manifest / action-gh-release steps are removed — the publish-gh-pages action now creates and uploads those release assets (asset-name: lecture-jax-html). The jax/GPU install, LaTeX PDF, download notebooks, and the lecture-jax.notebooks sync are unchanged. Requires a maintainer to switch Pages source to "GitHub Actions", add a publish* deployment tag rule to the github-pages environment, and delete gh-pages after a verified deploy. See QuantEcon/meta#282 Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/publish.yml | 52 +++++++++++++++-------------------- 1 file changed, 22 insertions(+), 30 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2d0ad5aa..9e9f12e7 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -3,10 +3,25 @@ on: push: tags: - 'publish*' + +# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages +permissions: + contents: write # write: upload release assets (html archive, checksum, manifest) + pages: write + id-token: write # required for OIDC-based Pages deployment + +# Allow only one concurrent deployment; don't cancel an in-flight deploy +concurrency: + group: "pages" + cancel-in-progress: false + jobs: publish: if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags') runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false" + environment: + name: github-pages + url: ${{ steps.deployment.outputs.page-url }} steps: - name: Checkout uses: actions/checkout@v7 @@ -73,38 +88,15 @@ jobs: shell: bash -l {0} run: | jb build lectures --path-output ./ -n -W --keep-going - # Create HTML archive for release assets - - name: Create HTML archive - shell: bash -l {0} - run: | - tar -czf lecture-jax-html-${{ github.ref_name }}.tar.gz -C _build/html . - sha256sum lecture-jax-html-${{ github.ref_name }}.tar.gz > html-checksum.txt - - # Create metadata manifest - cat > html-manifest.json << EOF - { - "tag": "${{ github.ref_name }}", - "commit": "${{ github.sha }}", - "timestamp": "$(date -Iseconds)", - "size_mb": $(du -sm _build/html | cut -f1), - "file_count": $(find _build/html -type f | wc -l) - } - EOF - - name: Upload archives to release - uses: softprops/action-gh-release@v3 - with: - files: | - lecture-jax-html-${{ github.ref_name }}.tar.gz - html-checksum.txt - html-manifest.json - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Deploy website to gh-pages - uses: peaceiris/actions-gh-pages@v4 + - name: Deploy to GitHub Pages + id: deployment + uses: quantecon/actions/publish-gh-pages@v0.6.0 with: - github_token: ${{ secrets.GITHUB_TOKEN }} - publish_dir: _build/html/ + build-dir: _build/html cname: jax.quantecon.org + create-release-assets: 'true' + asset-name: 'lecture-jax-html' + github-token: ${{ secrets.GITHUB_TOKEN }} - name: Prepare lecture-jax.notebooks sync shell: bash -l {0} run: | From 2eb23b6c12b6c084ce3d498e62d44a2f8730b3af Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Wed, 8 Jul 2026 07:49:02 +1000 Subject: [PATCH 2/2] Add actions: read for the cache artifact download (Copilot review) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The explicit permissions block set all unlisted scopes to none, so the dawidd6/action-download-artifact step (which reads the build cache from cache.yml via the Actions API) had no actions:read. Add it so the cache download works reliably — important for this GPU build, where a cache miss means rebuilding every jax notebook from scratch. Matches the permissions example in QuantEcon/meta#282. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/publish.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 9e9f12e7..7adc54cb 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,6 +7,7 @@ on: # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages permissions: contents: write # write: upload release assets (html archive, checksum, manifest) + actions: read # dawidd6/action-download-artifact reads the cache.yml build artifact pages: write id-token: write # required for OIDC-based Pages deployment