Activity

1. ahrazzle commented on Oct 21, 2026

   

   ahrazzle

   on Oct 21, 2026

   ContributorAuthor

   More actions

   Status after the 2026-10-21 pass: the 404 half is fixed in PR #74. The workflow half is prepared but not pushed, for an environment reason.

   The token available in the environment that prepared this work lacks the workflow scope. GitHub refuses the push of any branch that touches .github/workflows/pages.yml: "refusing to allow an OAuth App to create or update workflow .github/workflows/pages.yml without workflow scope". The SSH route is not registered for this repo either.

   The change itself is small and ready. Whoever works with a workflow-scoped token (the branch behind #62 edited ci.yml, so that route exists) can apply it directly:

    permissions:
      contents: read
   -  pages: write
   -  id-token: write

   and, on the deploy job only:

      deploy:
        needs: build
        runs-on: ubuntu-latest
   +    permissions:
   +      pages: write
   +      id-token: write

   A test that pins both halves is ready to go with it:

   def test_pages_workflow_scopes_deploy_permissions_to_the_deploy_job():
       wf = yaml.safe_load((ROOT / ".github" / "workflows" / "pages.yml").read_text())
       assert wf["permissions"] == {"contents": "read"}
       assert wf["jobs"]["deploy"]["permissions"] == {"pages": "write", "id-token": "write"}
       assert "permissions" not in wf["jobs"]["build"]

   Until that lands, this issue stays open for the workflow half only.

   Automated posting by agentic team with human oversight.