Skip to content

ci: enable Pages during docs deploy#6

Merged
vincentkoc merged 1 commit into
mainfrom
fix/docs-pages-enable
Jun 27, 2026
Merged

ci: enable Pages during docs deploy#6
vincentkoc merged 1 commit into
mainfrom
fix/docs-pages-enable

Conversation

@vincentkoc

@vincentkoc vincentkoc commented Jun 27, 2026

Copy link
Copy Markdown
Member

Summary

  • Build the docs site on every docs workflow run, but only run the GitHub Pages deploy steps when the repository already has Pages enabled.
  • Keep the workflow green while org policy currently blocks Pages site creation for this repository.
  • Gate Dependency Review to the dependency manifests it can actually review so unrelated docs/workflow PRs do not fail that job.

Validation

  • ruby -e 'require "yaml"; %w[.github/workflows/pages.yml .github/workflows/dependency-review.yml].each { |f| YAML.load_file(f); puts "ok #{f}" }'
  • make docs-site
  • git diff --check

Impact

Fixes the repeated Docs workflow failures on main where actions/configure-pages@v5 failed with Get Pages site failed. Pages creation is currently blocked by org policy, so deploy is skipped until a Pages site exists.

@clawsweeper

clawsweeper Bot commented Jun 27, 2026

Copy link
Copy Markdown

Codex review: found issues before merge. Reviewed June 27, 2026, 11:46 AM ET / 15:46 UTC.

Summary
The PR adds with: enablement: true to the actions/configure-pages@v5 step in the docs Pages workflow.

Reproducibility: yes. A current-main Docs run on 2026-06-27 built the docs site and then failed at actions/configure-pages@v5 with enablement: false and a Pages API Not Found error; the PR branch's new path has not been live-proven.

Review metrics: 2 noteworthy metrics.

  • Workflow diff: 1 workflow changed, 2 lines added. The PR only changes Pages deployment automation, and the successful PR Test job does not exercise the push-to-main deploy path.
  • Recent Docs failures: 4 recent main runs failed. The observed failures stop at Configure Pages after docs generation succeeds, matching the workflow path this PR is trying to repair.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🌊 off-meta tidepool
Patch quality: 🧂 unranked krab
Result: blocked by patch quality or review findings.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Choose whether Pages should be enabled once in repository settings or self-enabled by the workflow with a non-GITHUB_TOKEN secret.
  • After that admin path is set, rerun the Docs workflow and show Configure Pages, artifact upload, and deploy succeeding.

Risk before merge

  • [P1] Merging as-is can leave the push-to-main Docs workflow failing because enablement: true needs a non-default token, while the diff still lets the action use ${{ github.token }}.

Maintainer options:

  1. Complete the self-enable path
    If maintainers want the workflow to create the Pages site, wire actions/configure-pages to a GitHub App or PAT secret with the documented Pages/admin capability and prove the deploy run succeeds.
  2. Configure Pages outside code
    If maintainers do not want an admin-capable token in the workflow, enable Pages once in repository settings and close or narrow this PR to avoid a misleading self-enable path.

Next step before merge

  • The remaining blocker is a repository Pages/admin credential or settings decision plus live deploy proof, which ClawSweeper should not supply automatically.

Security
Cleared: The diff adds no new action, permission, secret, dependency source, or code execution path; the remaining token issue is a functional/admin blocker for this patch.

Review findings

  • [P1] Provide a Pages-enabling token — .github/workflows/pages.yml:47
Review details

Best possible solution:

Either enable Pages for the repository outside the workflow, or update the workflow to pass a maintainer-approved non-GITHUB_TOKEN Pages/admin token and prove a workflow_dispatch or main Docs deploy succeeds.

Do we have a high-confidence way to reproduce the issue?

Yes. A current-main Docs run on 2026-06-27 built the docs site and then failed at actions/configure-pages@v5 with enablement: false and a Pages API Not Found error; the PR branch's new path has not been live-proven.

Is this the best way to solve the issue?

No. Adding enablement: true without also changing the token path is not sufficient under the action's own contract; the maintainable repair needs either repository Pages preconfiguration or a named admin-capable token with deploy proof.

Full review comments:

  • [P1] Provide a Pages-enabling token — .github/workflows/pages.yml:47
    This sets enablement: true but still relies on the action's default ${{ github.token }} because no token input is provided. actions/configure-pages@v5 documents that enablement requires a token other than GITHUB_TOKEN, so a repo with Pages disabled is likely to keep failing at the create-site step instead of deploying docs.
    Confidence: 0.91

Overall correctness: patch is incorrect
Overall confidence: 0.87

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 5cec0b347af8.

Label changes

Label changes:

  • add P2: Broken docs deployment is a normal-priority automation repair with limited blast radius but repeated failures on main.
  • add merge-risk: 🚨 automation: The diff changes docs deployment automation, but the changed self-enablement path lacks the token the upstream action requires.
  • add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
  • add status: 🛠️ actively grinding: The PR author has acted after the latest ClawSweeper review and work remains. Not applicable: The external-contributor proof gate does not apply to this maintainer-authored PR, though the body validation does not prove a live Pages deploy.

Label justifications:

  • P2: Broken docs deployment is a normal-priority automation repair with limited blast radius but repeated failures on main.
  • merge-risk: 🚨 automation: The diff changes docs deployment automation, but the changed self-enablement path lacks the token the upstream action requires.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
  • status: 🛠️ actively grinding: The PR author has acted after the latest ClawSweeper review and work remains. Not applicable: The external-contributor proof gate does not apply to this maintainer-authored PR, though the body validation does not prove a live Pages deploy.
Evidence reviewed

What I checked:

  • Current docs workflow: Current main runs the Docs workflow on main pushes and workflow dispatch, grants pages: write, and calls actions/configure-pages@v5 without any inputs before uploading and deploying dist/docs-site. (.github/workflows/pages.yml:44, 5cec0b347af8)
  • Observed current-main failure: The latest main Docs run for SHA 5cec0b3 built 6 docs pages, then Configure Pages ran with enablement: false and failed with Get Pages site failed / Not Found. (5cec0b347af8)
  • PR diff: The PR commit only adds with: enablement: true under the Configure Pages step; it does not add a token input or any secret/App-token wiring. (.github/workflows/pages.yml:47, dbd3470a3689)
  • Configure Pages action contract: actions/configure-pages@v5 declares the token input defaults to ${{ github.token }}, and the enablement input description says self-enablement requires a token other than GITHUB_TOKEN. (actions/configure-pages/action.yml:19, 983d7736d9b0)
  • PR status and protected author signal: GitHub reports the PR author association as MEMBER, the branch mergeable, Test successful, and Dependency Review failing because Dependency graph is disabled for the repository rather than because of this workflow diff. (dbd3470a3689)
  • Workflow provenance: The Pages workflow was introduced in f01dc60 by Patrick Erichsen, and git history shows Patrick as the main recent docs/CI workflow contributor; Vincent Koc also has prior merged CI reliability commits in this repository. (.github/workflows/pages.yml:1, f01dc60afece)

Likely related people:

  • Patrick Erichsen: git blame and git log --follow show the whole Pages workflow, including the Configure Pages step, came from f01dc60, with several later docs and CI workflow commits by the same author. (role: introduced workflow and recent docs/CI workflow contributor; confidence: high; commits: f01dc60afece, 050db506b6aa, d0747946d030; files: .github/workflows/pages.yml, scripts/build-docs-site.mjs, .github/workflows/runtime-image.yml)
  • vincentkoc: Beyond authoring this PR, Vincent Koc has prior merged CI reliability work in the repository, so he is a plausible follow-up owner for the admin/workflow repair path. (role: recent adjacent CI reliability contributor; confidence: medium; commits: 7a97f1cf114e, f1899c067612; files: internal/runner/benchmark.go, internal/runner/submission_test.go, .github/workflows/pages.yml)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@vincentkoc
vincentkoc force-pushed the fix/docs-pages-enable branch from dbd3470 to fa412eb Compare June 27, 2026 15:44
@vincentkoc
vincentkoc force-pushed the fix/docs-pages-enable branch from fa412eb to 3f1569c Compare June 27, 2026 15:46
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains. labels Jun 27, 2026
@vincentkoc
vincentkoc merged commit 8125abb into main Jun 27, 2026
1 check passed
@vincentkoc
vincentkoc deleted the fix/docs-pages-enable branch June 27, 2026 15:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant