fix(quarto-publish): pass GH_TOKEN to the Quarto setup step so TinyTeX install doesn't 403

[d-morrison]

Closes #270

The bug

quarto-publish/action.yml's "Set up Quarto" step called
quarto-dev/quarto-actions/setup with tinytex: ${{ inputs.tinytex }} but no
GH_TOKEN. With tinytex: true, quarto install tinytex looks up the latest
rstudio/tinytex-releases release via an unauthenticated GitHub API call,
which intermittently fails on shared runners:

ERROR: Unable to determine latest release for rstudio/tinytex-releases
403 - Forbidden

This repeatedly broke ucdavis/win's builds (per #270) until its bespoke step
got the token.

The fix

Add env: GH_TOKEN: ${{ github.token }} to that step, so the release lookup is
authenticated. This mirrors the preview composite, whose identical
"Set up Quarto" step already passes GH_TOKEN: ${{ github.token }} (in-repo
precedent).

Scope

The change is internal to the composite -- no new input, no interface change.
The reusable workflow .github/workflows/quarto-publish.yml just calls
Morrison-Lab/gha/quarto-publish@v2 (it does not duplicate the setup step), so
the fix propagates automatically; the examples/quarto-publish.yml stub needs
no change. Only callers with tinytex: true are affected.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Claude finished review — View run

---

Code review — PR #431

Summary: Adds env: GH_TOKEN: ${{ github.token }} to quarto-publish/action.yml's "Set up Quarto" step, authenticating quarto install tinytex's GitHub API lookup against rstudio/tinytex-releases so it stops intermittently 403ing on shared runners (closes #270), plus a matching changelog.d/ fragment. It's a minimal, surgical, two-file change.

Findings from this review:

• Both CLAUDE.md-compliance passes and both bug-focused passes came back clean on the diff itself: the YAML is syntactically valid, ${{ github.token }} is the correct expression (composite actions can't read secrets.GITHUB_TOKEN directly), GH_TOKEN is the env var quarto install's underlying tooling reads for this lookup, and the change byte-for-byte matches the already-shipped precedent in preview/action.yml:75-78 — verified directly by reading that file, so the changelog fragment's "matches the preview composite" claim checks out. No new workflow_call input, no interface change, so no wrapper/examples/ sync is needed, and .github/workflows/quarto-publish.yml was confirmed not to duplicate the setup step. The changelog fragment follows the <slug>.<category>.md convention correctly.

• Non-blocking scope/completeness gap (not in the diff, so not tied to a diff line — no inline comment possible): two other call sites of the same pinned quarto-dev/quarto-actions/setup@8a96df1 action in this repo also hardcode tinytex: true with no GH_TOKEN set, so the same 403 can still reproduce through them:

  • .github/workflows/altdoc-multiversion-docs.yml:229-233 (job-level env: at 155-157 sets only GITHUB_PAT/DOCS_SOURCE_DIR, neither of which Quarto's installer reads)
  • .github/workflows/claude.yml:480-484 (no step-level env:, unlike this file's other steps at 304/411/521/535 which do set GH_TOKEN)

  (gemini.yml:316-318 is a third setup call site but passes no tinytex input, so it's unaffected.) This was independently confirmed by re-reading both files. It doesn't make the PR's own fix wrong, but "Closes quarto-publish: pass GH_TOKEN to the Quarto setup step (TinyTeX release lookup 403s unauthenticated) #270" plus the fragment's phrasing could read as "the class of failure is now handled," when in fact two other in-repo call sites remain exposed to the identical bug. Worth either extending the same one-line env: block to those two sites in this PR (or a fast follow-up), or narrowing the changelog wording to scope the fix explicitly to quarto-publish/preview rather than implying repo-wide coverage. This is a suggestion, not a blocker — the shipped fix is correct and complete for quarto-publish itself.

No AI-hallucination concerns (no fabricated APIs/symbols — GH_TOKEN, github.token, and the pinned action all check out), no prose-quality issues in the changelog fragment, and no line-specific findings to post as inline comments (the one gap found lies outside this diff's changed lines).

Verdict

Ready for merge (with an optional non-blocking follow-up to close the same gap in altdoc-multiversion-docs.yml and claude.yml, or to file it as a tracked issue).

[github-actions]

💰 Cost: $4.2025 (review) — run

[d-morrison]

ARD summary

Verdict Ready for merge; the diff itself is verified correct against the preview precedent, 0 threads.

The one non-blocking finding (two other Quarto-setup call sites -- altdoc-multiversion-docs.yml and claude.yml -- exposed to the same 403): Deferred to #432. Confirmed both are genuinely exposed (altdoc's job env has only GITHUB_PAT; claude.yml sets GH_TOKEN on every setup-adjacent step except this one), and gemini.yml is correctly unaffected (no tinytex).

Not folded in here on purpose: both are .github/workflows/ files, so per #386 a PR editing them makes claude-review fail its workflow-content validation and produce no verdict -- extending this PR would have broken its own clean review. #432 tracks the fix (with the self-review/manual-merge caveat that follow-up will need).

The changelog fragment is already scoped to quarto-publish specifically (it names the capability, doesn't claim repo-wide coverage), so no wording change is needed.