Conversation
actions/checkout defaults persist-credentials to true, so both of these jobs were leaving a write-scoped token in .git/config that nothing reads. - preview.yml (deploy): rossjrw/pr-preview-action authenticates via its `token` input, which it forwards to JamesIves/github-pages-deploy-action; neither reads .git/config. - publish-to-testpypi-and-pypi.yml (create-github-release): the job only reads VERSION.txt and CHANGELOG.md, and the release step takes its token from the environment. No behaviour change.
actions/create-release was archived in March 2021 and its own README points users elsewhere. ubuntu-latest ships gh preinstalled, so the release can be cut directly with no third-party action to pin or trust. While moving the step: - pass the notes via --notes-file instead of a GITHUB_ENV heredoc, whose EOF delimiter could in principle collide with the changelog text; - fail loudly when CHANGELOG.md has no section for the tagged version, rather than publishing a release with an empty body. The awk extraction itself is unchanged; verified locally that it still produces the expected notes for 0.24.0.
publish-doc-to-gh-pages.yml was the last workflow running repository code next to a contents:write token. `pip install .[docs]` executes packaging code and mkdocs.yml enables markdown_exec, which runs Python from docs/ at build time -- previously with a write-scoped credential sitting in .git/config, because `mkdocs gh-deploy` shells out to `git push` and so needs persist-credentials to stay on. Mirror preview.yml instead: an unprivileged build job that only emits an artifact, and a deploy job that holds the write permission but executes nothing from the repository. mkdocs gh-deploy is replaced by JamesIves/github-pages-deploy-action, which authenticates from its `token` input, so no workflow in the repository persists credentials any more. This also fixes a standing bug: `mkdocs gh-deploy --force` replaces the whole gh-pages tree, so every release wiped the pr-preview/ directory that preview.yml maintains, killing the previews of all open pull requests. clean-exclude now preserves it.
Contributor
|
7 tasks
Fenkiou
reviewed
Sep 10, 2026
| } >> "$GITHUB_ENV" | ||
|
|
||
| if [ -z "$notes" ]; then | ||
| echo "No CHANGELOG.md section found for version '$version'" |
Member
There was a problem hiding this comment.
Do we really want to make the job fail if nothing in the changelog? I mean the tag is created and package is released to pypi at this point.
Member
There was a problem hiding this comment.
Please sync with @thomasbaronnet because he's changing this so we get doc versioning in #294, I'd rather change things there instead of in this PR as this refactor doesn't seem really necessary ;)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
persist-credentialsexplicitactions/create-releasewithgh release createbuild+deployto avoid running too many commands (e.g.mkdocs) with awritetokenRemaining Tasks
Related PRs in other projects (PASQAL developers only)
Additional merge criteria
Breaking changes
Checklist
Versioning (PASQAL developers only)
VERSION.txtfollowing the changes in your PR and by using semantic versioning.Documentation
Tests
Internal tests pipeline (PASQAL developers only)
If your PR hasn't changed any functionality, it still needs to be validated against internal tests.
After updating the version (PASQAL developers only)