From fce05b741c9f964ff8e07168066531de644fda9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Richard=20Sol=C3=A1r?= Date: Thu, 5 Nov 2026 16:52:29 +0100 Subject: [PATCH 1/2] ci: stop re-resolving @apify/docs-theme in the docs build The docs build ran `pnpm add @apify/docs-theme@latest`, which resolves a fresh tree outside the lockfile. Every transitive dependency then has to pass `minimumReleaseAge: 10080` (7 days), and the postcss/csstools chain the theme pulls in is republished far more often than that, so the build has been red since 2026-11-04. Install from the lockfile instead and let Renovate move the pin. Co-Authored-By: Claude Opus 5 --- .github/workflows/docs.yaml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 483aa1ddc..7c7132f2d 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -37,7 +37,6 @@ jobs: - name: Build docs run: | pnpm run update-docs - pnpm --filter apify-cli-website add @apify/docs-theme@latest pnpm --filter apify-cli-website run build env: SMARTLOOK_PROJECT_KEY: ${{ secrets.SMARTLOOK_DOCS_PROJECT_KEY }} @@ -46,13 +45,6 @@ jobs: APIFY_SIGNING_TOKEN: ${{ secrets.APIFY_SIGNING_TOKEN }} SEGMENT_TOKEN: ${{ secrets.SEGMENT_TOKEN }} - - name: Commit the updated package(-lock).json - uses: apify/actions/signed-commit@v1.6.2 - with: - message: "chore: Automatic theme updating workflow [skip ci]" - add: 'website/package.json pnpm-lock.yaml' - github-token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - - name: Set up GitHub Pages uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 From 674ee27c2f8c0d568d68d1be0be1ca93fe5d93cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Richard=20Sol=C3=A1r?= Date: Thu, 5 Nov 2026 17:00:30 +0100 Subject: [PATCH 2/2] ci: drop the service-account PAT and write access from the docs build Nothing in the job writes to the repository any more, and neither the build scripts nor the theme read GH_TOKEN or GIT_USER. Checkout now uses the default token and the job only needs contents: read. The CloudFront invalidation keeps its own token, which it still needs. Co-Authored-By: Claude Opus 5 --- .github/workflows/docs.yaml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 7c7132f2d..7d233d772 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -14,7 +14,7 @@ jobs: name: github-pages permissions: - contents: write + contents: read pages: write id-token: write @@ -22,8 +22,6 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Use Node.js uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -40,8 +38,6 @@ jobs: pnpm --filter apify-cli-website run build env: SMARTLOOK_PROJECT_KEY: ${{ secrets.SMARTLOOK_DOCS_PROJECT_KEY }} - GIT_USER: "apify-service-account:${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}" - GH_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} APIFY_SIGNING_TOKEN: ${{ secrets.APIFY_SIGNING_TOKEN }} SEGMENT_TOKEN: ${{ secrets.SEGMENT_TOKEN }}