From e78c7f40677cdd34489f7ff7ebc05a96fa7e1d4c Mon Sep 17 00:00:00 2001
From: Alex Reinking <areinking@adobe.com>
Date: Wed, 19 Aug 2026 18:04:58 -0400
Subject: [PATCH] Fix deploy-docs.yml push permission and drop unused
 target_repo input

actions/create-github-app-token defaults to scoping the minted token to
the *current* repo (halide/Halide) unless told otherwise, regardless of
which other repos the GitHub App is installed on -- so despite the
halide-ci app having write access to halide.github.com, the final push
step was always denied with a 403. Pass owner/repositories explicitly
so the token is scoped to halide.github.com instead.

While here, drop the target_repo workflow_dispatch input: this workflow
has only ever deployed to halide/halide.github.com and rehearsing
against a personal fork wasn't a realistic use case, so hardcode it and
simplify the env/step wiring accordingly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/deploy-docs.yml | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 09fc660fdbd0..a1912bc92d3a 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -5,19 +5,12 @@ on:
     types: [ published ]
   workflow_dispatch:
     inputs:
-      target_repo:
-        description: >-
-          Repo to deploy to. Override with a personal fork (e.g.
-          your-username/halide.github.com) to rehearse a real push
-          without touching the live site.
-        default: halide/halide.github.com
-        required: false
       dry_run:
         description: >-
-          Build and diff only -- never push anywhere, even to target_repo
-          above. Uploads the generated docs/ as a workflow artifact instead,
-          for manual inspection. This is the safe default for testing changes
-          to this workflow or the generator itself.
+          Build and diff only -- never push to halide.github.com. Uploads
+          the generated docs/ as a workflow artifact instead, for manual
+          inspection. This is the safe default for testing changes to this
+          workflow or the generator itself.
         type: boolean
         default: true
 
@@ -25,7 +18,8 @@ permissions:
   contents: read
 
 env:
-  TARGET_REPO: ${{ github.event.inputs.target_repo || 'halide/halide.github.com' }}
+  TARGET_REPO_OWNER: halide
+  TARGET_REPO_NAME: halide.github.com
   # Only ever a real push for `release` events -- any workflow_dispatch run
   # defaults to a dry run unless explicitly opted out.
   DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run || 'false' }}
@@ -75,6 +69,13 @@ jobs:
         with:
           app-id: ${{ secrets.LLVM_UPDATER_ID }}
           private-key: ${{ secrets.LLVM_UPDATER_PRIVATE_KEY }}
+          # Without these, the action scopes the token to the *current*
+          # repo (halide/Halide) rather than halide.github.com, since
+          # that's where this workflow itself lives -- leaving it unable
+          # to push to halide.github.com despite the app being installed
+          # there.
+          owner: ${{ env.TARGET_REPO_OWNER }}
+          repositories: ${{ env.TARGET_REPO_NAME }}
 
       - name: Get GitHub App user ID
         id: get-user-id
@@ -82,10 +83,10 @@ jobs:
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
 
-      - name: Checkout ${{ env.TARGET_REPO }}
+      - name: Checkout ${{ env.TARGET_REPO_OWNER }}/${{ env.TARGET_REPO_NAME }}
         uses: actions/checkout@v7
         with:
-          repository: ${{ env.TARGET_REPO }}
+          repository: ${{ env.TARGET_REPO_OWNER }}/${{ env.TARGET_REPO_NAME }}
           ref: master
           token: ${{ steps.app-token.outputs.token }}
           path: halide.github.com