From 4204462c42843c5af4eda95b317f0ad6c14095f4 Mon Sep 17 00:00:00 2001 From: d-morrison Date: Thu, 6 Aug 2026 03:00:59 -0700 Subject: [PATCH 1/2] start: pass GH_TOKEN to quarto-publish TinyTeX setup (closes #270) From 44541de13b620e5c14be2d477a0c9c6f1bea670f Mon Sep 17 00:00:00 2001 From: d-morrison Date: Thu, 6 Aug 2026 03:02:20 -0700 Subject: [PATCH 2/2] fix(quarto-publish): pass GH_TOKEN to the Quarto setup step so TinyTeX install doesn't 403 quarto-publish/action.yml's 'Set up Quarto' step called quarto-actions/setup with tinytex but no GH_TOKEN. With tinytex: true, 'quarto install tinytex' looks up the latest rstudio/tinytex-releases release via an UNauthenticated GitHub API call, which intermittently fails on shared runners with: ERROR: Unable to determine latest release for rstudio/tinytex-releases 403 - Forbidden Add env: GH_TOKEN: ${{ github.token }} to that step, matching the preview composite (which already authenticates the identical setup step). Internal to the composite -- no new input -- so the reusable workflow (which just calls the composite) and the example stub need no change. Closes #270 Co-Authored-By: Claude Opus 4.8 --- changelog.d/quarto-publish-tinytex-gh-token.fixed.md | 9 +++++++++ quarto-publish/action.yml | 5 +++++ 2 files changed, 14 insertions(+) create mode 100644 changelog.d/quarto-publish-tinytex-gh-token.fixed.md diff --git a/changelog.d/quarto-publish-tinytex-gh-token.fixed.md b/changelog.d/quarto-publish-tinytex-gh-token.fixed.md new file mode 100644 index 00000000..f609ef5f --- /dev/null +++ b/changelog.d/quarto-publish-tinytex-gh-token.fixed.md @@ -0,0 +1,9 @@ +- **`quarto-publish`'s TinyTeX install no longer 403s on shared runners** + (#270). + The "Set up Quarto" step now passes `GH_TOKEN: ${{ github.token }}`, + so `quarto install tinytex`'s latest-release lookup against + `rstudio/tinytex-releases` is authenticated rather than an unauthenticated + GitHub API call that intermittently fails with `403 - Forbidden` + (`Unable to determine latest release for rstudio/tinytex-releases`). + Only affects callers with `tinytex: true`; matches the `preview` composite, + which already authenticates the same step. diff --git a/quarto-publish/action.yml b/quarto-publish/action.yml index 1565df12..ace69134 100644 --- a/quarto-publish/action.yml +++ b/quarto-publish/action.yml @@ -56,6 +56,11 @@ runs: - name: Set up Quarto uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0 + env: + # `quarto install tinytex` looks up the latest `rstudio/tinytex-releases` + # release via the GitHub API; unauthenticated, that intermittently 403s on + # shared runners (#270). Authenticate it, matching the `preview` composite. + GH_TOKEN: ${{ github.token }} with: tinytex: ${{ inputs.tinytex }}