From 4d43bf45876a016eabadc3af0617df27b0d5aefc Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Wed, 5 Aug 2026 12:36:56 +1000 Subject: [PATCH 1/2] Add a permissions block to ci.yml so the default token can drop to read The Netlify preview step is the one consumer of the default token's write access here; contents:read + pull-requests:write is the same block lecture-jax/ci.yml already carries. The other workflows either have blocks or write nothing with GITHUB_TOKEN. Part of QuantEcon/meta#347 item 4. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8a4f58aa..b537f557 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,6 +3,9 @@ on: [pull_request] jobs: preview: runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false" + permissions: + contents: read + pull-requests: write steps: - uses: actions/checkout@v7 with: From ed269d9e8ec3b7fa89f41c2b56644a00c64993ac Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Wed, 5 Aug 2026 13:13:04 +1000 Subject: [PATCH 2/2] Grant actions: read for the cache artifact download Public-repo API leniency is what lets dawidd6/action-download-artifact work without the scope today; the grant matches the documented requirement and the comment publish.yml already carries. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b537f557..013e28d6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,6 +5,7 @@ jobs: runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false" permissions: contents: read + actions: read # dawidd6/action-download-artifact reads the cache.yml build artifact pull-requests: write steps: - uses: actions/checkout@v7