Follow-up from #270 / #431. The #431 review found two other in-repo call sites of quarto-dev/quarto-actions/setup@8a96df1 that pass tinytex: true with no GH_TOKEN, so quarto install tinytex's rstudio/tinytex-releases latest-release lookup is unauthenticated and can 403 on shared runners (the exact #270 signature):
.github/workflows/altdoc-multiversion-docs.yml "Set up Quarto" step (~L229-233). Job-level env: sets only GITHUB_PAT/DOCS_SOURCE_DIR, neither of which Quarto's installer reads..github/workflows/claude.yml "Set up Quarto" step (~L480-484). No step-level env:, unlike that file's other steps which set GH_TOKEN per step.
(gemini.yml's setup call passes no tinytex, so it is unaffected.)
Fix
Add a step-level env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} to each, matching those files' local convention (they use secrets.GITHUB_TOKEN, not the composite-only github.token).
Why not folded into #431
Both files are under .github/workflows/, so per #386 a PR editing them makes the dispatched claude-review fail its workflow-content validation ("must have identical content to the default branch") and produce no verdict. Folding these into #431 would have broken #431's own clean review. This PR will therefore need a self-review + manual merge, per CLAUDE.md's "A PR fixing claude-code-review.yml (or claude.yml) itself can't self-verify" section.
Follow-up from #270 / #431. The #431 review found two other in-repo call sites of
quarto-dev/quarto-actions/setup@8a96df1that passtinytex: truewith noGH_TOKEN, soquarto install tinytex'srstudio/tinytex-releaseslatest-release lookup is unauthenticated and can 403 on shared runners (the exact #270 signature):.github/workflows/altdoc-multiversion-docs.yml"Set up Quarto" step (~L229-233). Job-levelenv:sets onlyGITHUB_PAT/DOCS_SOURCE_DIR, neither of which Quarto's installer reads..github/workflows/claude.yml"Set up Quarto" step (~L480-484). No step-levelenv:, unlike that file's other steps which setGH_TOKENper step.(
gemini.yml's setup call passes notinytex, so it is unaffected.)Fix
Add a step-level
env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}to each, matching those files' local convention (they usesecrets.GITHUB_TOKEN, not the composite-onlygithub.token).Why not folded into #431
Both files are under
.github/workflows/, so per #386 a PR editing them makes the dispatchedclaude-reviewfail its workflow-content validation ("must have identical content to the default branch") and produce no verdict. Folding these into #431 would have broken #431's own clean review. This PR will therefore need a self-review + manual merge, per CLAUDE.md's "A PR fixing claude-code-review.yml (or claude.yml) itself can't self-verify" section.