From e39fb9b21fcb2b6a508509b9c280bc0fe9b12c74 Mon Sep 17 00:00:00 2001 From: Jukka Kurkela Date: Thu, 17 Sep 2026 10:55:04 +0300 Subject: [PATCH] ci: deploy the docs with GITHUB_TOKEN instead of an expired PAT Every push to master has failed at "Release to GitHub Pages" since the docs were last deployed on 2025-02-15: [command]/usr/bin/git push origin gh-pages remote: Invalid username or token. Password authentication is not supported for Git operations. fatal: Authentication failed for 'https://github.com/chartjs/chartjs-plugin-zoom.git/' The GH_AUTH_TOKEN secret is set but no longer valid: it is a classic PAT created on 2021-04-25 and never rotated since. The clone step still works because the repository is public, so only the push fails. The runner's own GITHUB_TOKEN can do this job - it gets Contents: write, and gh-pages is already the configured Pages source - so use it and drop the dependency on a human-owned token that can expire again. The deploying jobs now declare contents: write explicitly, so they no longer rely on the repository default workflow permission staying "write". The same secret was used by the three Pages steps in publish-npm.yml, which would have failed the same way on the next release. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/documentation.yml | 4 +++- .github/workflows/publish-npm.yml | 10 +++++++--- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 5ac9f928..d6a00c30 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -23,6 +23,8 @@ jobs: gh-release: if: github.event_name == 'push' runs-on: ubuntu-latest + permissions: + contents: write steps: - uses: actions/checkout@v7 - uses: actions/setup-node@v7 @@ -36,6 +38,6 @@ jobs: - name: Release to GitHub Pages uses: peaceiris/actions-gh-pages@v4 with: - github_token: ${{ secrets.GH_AUTH_TOKEN }} + github_token: ${{ secrets.GITHUB_TOKEN }} publish_dir: dist/docs destination_dir: master diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index 5ed045eb..f1e0994a 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -31,6 +31,8 @@ jobs: publish-npm: needs: [test, setup] runs-on: ubuntu-latest + permissions: + contents: write steps: - uses: actions/checkout@v7 - uses: actions/setup-node@v7 @@ -95,13 +97,15 @@ jobs: - name: Release to GitHub Pages (version) uses: peaceiris/actions-gh-pages@v4 with: - github_token: ${{ secrets.GH_AUTH_TOKEN }} + github_token: ${{ secrets.GITHUB_TOKEN }} publish_dir: dist/docs destination_dir: ${{ needs.setup.outputs.version }} publish-docs: needs: [test, setup] runs-on: ubuntu-latest + permissions: + contents: write steps: - uses: actions/checkout@v7 - uses: actions/setup-node@v7 @@ -122,7 +126,7 @@ jobs: if: github.event.release.prerelease == false uses: peaceiris/actions-gh-pages@v4 with: - github_token: ${{ secrets.GH_AUTH_TOKEN }} + github_token: ${{ secrets.GITHUB_TOKEN }} publish_dir: dist/docs destination_dir: latest @@ -130,6 +134,6 @@ jobs: if: github.event.release.prerelease == true uses: peaceiris/actions-gh-pages@v4 with: - github_token: ${{ secrets.GH_AUTH_TOKEN }} + github_token: ${{ secrets.GITHUB_TOKEN }} publish_dir: dist/docs destination_dir: next