From 4865a97e0ff2f49b4ecaf9b8571534bf94318713 Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Wed, 5 Aug 2026 12:58:24 +1000 Subject: [PATCH 1/3] MAINT: consolidate GPU workflow config (volume, spot, permissions) Lands three overlapping PRs as one commit, since #51, #52 and #53 all rewrite the same few lines of ci.yml and collab.yml and conflict pairwise. - runs-on: disk=large -> volume=80gb (the v3 label rename), and spot=false on all four GPU workflows. Final state now matches lecture-jax and lecture-python.myst byte for byte, allowing for collab.yml's different image (ubuntu24-gpu-x64). - Explicit job-level permissions on ci.yml and collab.yml, and a top-level block on publish.yml, so the default workflow token can drop to read. Both ci.yml and collab.yml gain `actions: read` alongside the permissions block from #53, which declared it only on publish.yml. It is not currently load-bearing -- lecture-jax runs dawidd6/action-download-artifact green with contents+pull-requests alone, because public-repo tokens can read Actions data regardless -- but declaring it keeps the three files consistent and removes the reliance on that behaviour. Replaces #51, #52 and #53. Part of the rollout tracked in QuantEcon/meta#330, with the permissions work from QuantEcon/meta#347. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/cache.yml | 2 +- .github/workflows/ci.yml | 6 +++++- .github/workflows/collab.yml | 6 +++++- .github/workflows/publish.yml | 5 ++++- 4 files changed, 15 insertions(+), 4 deletions(-) diff --git a/.github/workflows/cache.yml b/.github/workflows/cache.yml index ca2472e..e617bc8 100644 --- a/.github/workflows/cache.yml +++ b/.github/workflows/cache.yml @@ -6,7 +6,7 @@ on: workflow_dispatch: jobs: cache: - runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/disk=large" + runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false" steps: - uses: actions/checkout@v6 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3abacad..e40a5a3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,7 +2,11 @@ name: Build Project [using jupyter-book] on: [pull_request] jobs: preview: - runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/disk=large" + runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false" + permissions: + contents: read + pull-requests: write + actions: read # dawidd6/action-download-artifact reads the cache.yml build artifact steps: - uses: actions/checkout@v6 with: diff --git a/.github/workflows/collab.yml b/.github/workflows/collab.yml index 32e1588..64dba07 100644 --- a/.github/workflows/collab.yml +++ b/.github/workflows/collab.yml @@ -2,7 +2,11 @@ name: Build Project on Google Collab (Execution) on: [pull_request] jobs: execution-checks: - runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=ubuntu24-gpu-x64/disk=large" + runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=ubuntu24-gpu-x64/volume=80gb/spot=false" + permissions: + contents: read + pull-requests: write + actions: read # dawidd6/action-download-artifact reads the cache.yml build artifact container: image: docker://us-docker.pkg.dev/colab-images/public/runtime options: --gpus all diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index afcefd0..c06c5b2 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -3,10 +3,13 @@ on: push: tags: - 'publish*' +permissions: + contents: write # peaceiris/actions-gh-pages pushes the built site to gh-pages + actions: read # dawidd6/action-download-artifact reads the cache.yml build artifact jobs: publish: if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags') - runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/disk=large" + runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false" steps: - name: Checkout uses: actions/checkout@v6 From 9f351e6bedeb0c6ff77327a109a4d69733217356 Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Wed, 5 Aug 2026 12:59:03 +1000 Subject: [PATCH 2/3] MAINT: bump dawidd6/action-download-artifact to v21 everywhere Brings all four call sites (ci, collab, linkcheck, publish) onto a single version. collab.yml was still on v3 while the rest were on v9. v21 over dependabot's v14 (#50): it has roughly three months of soak rather than one day, runs on node24 so it clears the Node 20 deprecation warning that v14 keeps, and matches what lecture-jax already runs green. The input surface this repo uses -- workflow, branch, name, path -- is unchanged across v3, v9, v14 and v21. One behaviour change is worth recording: allow_forks defaulted true in v3 and false from v9 onward, so collab.yml's behaviour does change. It is inert here because the step pins branch: main against an upstream workflow, so the runs being searched are never fork runs. Replaces #50, which dependabot will not update itself -- it has opened nothing in this repo since 2026-02-02. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci.yml | 2 +- .github/workflows/collab.yml | 2 +- .github/workflows/linkcheck.yml | 2 +- .github/workflows/publish.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e40a5a3..cf8e68a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,7 +39,7 @@ jobs: shell: bash -l {0} run: pip list - name: Download "build" folder (cache) - uses: dawidd6/action-download-artifact@v9 + uses: dawidd6/action-download-artifact@v21 with: workflow: cache.yml branch: main diff --git a/.github/workflows/collab.yml b/.github/workflows/collab.yml index 64dba07..a3f0fe5 100644 --- a/.github/workflows/collab.yml +++ b/.github/workflows/collab.yml @@ -26,7 +26,7 @@ jobs: shell: bash -l {0} run: pip list - name: Download "build" folder (cache) - uses: dawidd6/action-download-artifact@v3 + uses: dawidd6/action-download-artifact@v21 with: workflow: cache.yml branch: main diff --git a/.github/workflows/linkcheck.yml b/.github/workflows/linkcheck.yml index 7336404..f8ac2d5 100644 --- a/.github/workflows/linkcheck.yml +++ b/.github/workflows/linkcheck.yml @@ -27,7 +27,7 @@ jobs: environment-file: environment.yml activate-environment: quantecon - name: Download "build" folder (cache) - uses: dawidd6/action-download-artifact@v9 + uses: dawidd6/action-download-artifact@v21 with: workflow: cache.yml branch: main diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c06c5b2..cae7931 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -40,7 +40,7 @@ jobs: run: pip list # Download Build Cache from cache.yml - name: Download "build" folder (cache) - uses: dawidd6/action-download-artifact@v9 + uses: dawidd6/action-download-artifact@v21 with: workflow: cache.yml branch: main From 59014284caf6ce11191dbe95de2e85f3fb04ddcb Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Wed, 5 Aug 2026 12:59:30 +1000 Subject: [PATCH 3/3] FIX: add -n to the ci.yml PDF build so it matches publish.yml ci.yml's PDF build was the only `jb build` in the file without -n, while publish.yml:53 runs the same pdflatex build with -n -W. That gap let a nitpick-class error -- a bad cross-reference, unknown role or missing citation in the PDF path -- pass the PR check and then fail the tag-only publish build, where it is far more expensive to discover. Salvaged from #25, which is otherwise superseded by 230e90c. The rest of that PR is not carried forward: its bayes_nonconj.md edit is already on main in better form, and its _build upload step lacks the `if: failure()` guard its three siblings have. Note cache.yml:36 still builds HTML without -n. Left alone deliberately -- that workflow is currently failing and tightening it is a separate change. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cf8e68a..b17ca3f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -61,7 +61,7 @@ jobs: - name: Build PDF from LaTeX shell: bash -l {0} run: | - jb build lectures --builder pdflatex --path-output ./ -W --keep-going + jb build lectures --builder pdflatex --path-output ./ -n -W --keep-going mkdir -p _build/html/_pdf cp -u _build/latex/*.pdf _build/html/_pdf - name: Upload Execution Reports (LaTeX)