Fix deploy-docs.yml push permission and drop unused target_repo input

.github/workflows/deploy-docs.yml

@@ -5,27 +5,21 @@ on:
     types: [ published ]
   workflow_dispatch:
     inputs:
-      target_repo:
-        description: >-
-          Repo to deploy to. Override with a personal fork (e.g.
-          your-username/halide.github.com) to rehearse a real push
-          without touching the live site.
-        default: halide/halide.github.com
-        required: false
       dry_run:
         description: >-
-          Build and diff only -- never push anywhere, even to target_repo
-          above. Uploads the generated docs/ as a workflow artifact instead,
-          for manual inspection. This is the safe default for testing changes
-          to this workflow or the generator itself.
+          Build and diff only -- never push to halide.github.com. Uploads
+          the generated docs/ as a workflow artifact instead, for manual
+          inspection. This is the safe default for testing changes to this
+          workflow or the generator itself.
         type: boolean
         default: true
 
 permissions:
   contents: read
 
 env:
-  TARGET_REPO: ${{ github.event.inputs.target_repo || 'halide/halide.github.com' }}
+  TARGET_REPO_OWNER: halide
+  TARGET_REPO_NAME: halide.github.com
   # Only ever a real push for `release` events -- any workflow_dispatch run
   # defaults to a dry run unless explicitly opted out.
   DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run || 'false' }}
@@ -75,17 +69,24 @@ jobs:
         with:
           app-id: ${{ secrets.LLVM_UPDATER_ID }}
           private-key: ${{ secrets.LLVM_UPDATER_PRIVATE_KEY }}
+          # Without these, the action scopes the token to the *current*
+          # repo (halide/Halide) rather than halide.github.com, since
+          # that's where this workflow itself lives -- leaving it unable
+          # to push to halide.github.com despite the app being installed
+          # there.
+          owner: ${{ env.TARGET_REPO_OWNER }}
+          repositories: ${{ env.TARGET_REPO_NAME }}
 
       - name: Get GitHub App user ID
         id: get-user-id
         run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
 
-      - name: Checkout ${{ env.TARGET_REPO }}
+      - name: Checkout ${{ env.TARGET_REPO_OWNER }}/${{ env.TARGET_REPO_NAME }}
         uses: actions/checkout@v7
         with:
-          repository: ${{ env.TARGET_REPO }}
+          repository: ${{ env.TARGET_REPO_OWNER }}/${{ env.TARGET_REPO_NAME }}
           ref: master
           token: ${{ steps.app-token.outputs.token }}
           path: halide.github.com