From ea509dd58094b4daf07586d34a5c3a051c81d235 Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Tue, 14 Jul 2026 09:53:59 +1000 Subject: [PATCH 1/2] [preview] Migrate to quantecon/actions/preview-netlify Replace the third-party nwtgck/actions-netlify deploy with the org's own composite action quantecon/actions/preview-netlify@v0.8.0 (the same pin used in lecture-python.myst). It deploys via the Netlify CLI to a deterministic pr- alias, posts a single self-updating PR comment with direct links to the changed lecture pages, and safely skips dependabot/fork PRs that can't access secrets. Requires a Node.js setup step, added before it. Also drop the redundant Preview Deploy step from collab.yml: that job's purpose is execution testing on the Colab runtime, and its second deploy to the same Netlify site raced ci.yml for the PR alias (and published a lesser build with no notebook/PDF assets). ci.yml now owns the single canonical preview. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 16 ++++++++-------- .github/workflows/collab.yml | 10 ---------- 2 files changed, 8 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d3b013ca..7e9033d8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -69,13 +69,13 @@ jobs: with: name: execution-reports path: _build/html/reports + - name: Setup Node.js + uses: actions/setup-node@v6 + with: + node-version: '20' - name: Preview Deploy to Netlify - uses: nwtgck/actions-netlify@v4 + uses: quantecon/actions/preview-netlify@v0.8.0 with: - publish-dir: '_build/html/' - production-branch: main - github-token: ${{ secrets.GITHUB_TOKEN }} - deploy-message: "Preview Deploy from GitHub Actions" - env: - NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }} - NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }} + netlify-auth-token: ${{ secrets.NETLIFY_AUTH_TOKEN }} + netlify-site-id: ${{ secrets.NETLIFY_SITE_ID }} + build-dir: _build/html diff --git a/.github/workflows/collab.yml b/.github/workflows/collab.yml index be2e31d3..c851d24b 100644 --- a/.github/workflows/collab.yml +++ b/.github/workflows/collab.yml @@ -48,13 +48,3 @@ jobs: with: name: execution-reports path: _build/html/reports - - name: Preview Deploy to Netlify - uses: nwtgck/actions-netlify@v4 - with: - publish-dir: '_build/html/' - production-branch: main - github-token: ${{ secrets.GITHUB_TOKEN }} - deploy-message: "Preview Deploy from GitHub Actions" - env: - NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }} - NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }} From 883600b9e82cbe961a7d3d7111de7bb92fb8a18d Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Tue, 14 Jul 2026 14:20:38 +1000 Subject: [PATCH 2/2] [preview] Grant pull-requests: write for the PR preview comment The preview-netlify action posts/updates the preview comment via actions/github-script, which needs a write-scoped GITHUB_TOKEN. Without an explicit permissions block the job inherits the org default, which 403s under read-only tokens. Mirror lecture-python.myst: contents: read + pull-requests: write. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7e9033d8..37c8c7e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,6 +3,9 @@ on: [pull_request] jobs: preview: runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false" + permissions: + contents: read + pull-requests: write steps: - uses: actions/checkout@v7 with: