Skip to content

Replace PUBLISH_DOCS_TOKEN with Token Exchange Service token #342

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mrtenz merged 4 commits into from
Sep 2, 2026
+23 −17
Merged

Replace PUBLISH_DOCS_TOKEN with Token Exchange Service token #342

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
82bd6de
Replace PUBLISH_DOCS_TOKEN with Token Exchange Service token
mcmire Sep 1, 2026
ec2ba1e
Add missing permission
mcmire Sep 1, 2026
63173fb
Do not fail workflow, but show warning, if get-token fails
mcmire Sep 1, 2026
abf614e
Outcome is failure, not failed
mcmire Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,5 +123,4 @@ jobs:
uses: ./.github/workflows/publish-release.yml
secrets:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }}
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
25 changes: 19 additions & 6 deletions .github/workflows/publish-docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,6 @@ on:
destination_dir:
required: true
type: string
secrets:
PUBLISH_DOCS_TOKEN:
required: true
Comment thread
cursor[bot] marked this conversation as resolved.

jobs:
publish-docs-to-gh-pages:
Expand All @@ -17,22 +14,38 @@ jobs:
environment: github-pages
permissions:
contents: write
id-token: write
steps:
- name: Ensure `destination_dir` is not empty
if: ${{ inputs.destination_dir == '' }}
run: exit 1
- name: Get access token
id: get-token
uses: MetaMask/github-tools/.github/actions/get-token@v1
with:
token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }}
permissions: |
contents: write
continue-on-error: true
- name: Checkout and setup environment
if: ${{ steps.get-token.outcome == 'success' }}
uses: MetaMask/action-checkout-and-setup@v3
with:
is-high-risk-environment: true
persist-credentials: false
- name: Run build script
if: ${{ steps.get-token.outcome == 'success' }}
run: yarn build:docs
- name: Deploy to `${{ inputs.destination_dir }}` directory of `gh-pages` branch
if: ${{ steps.get-token.outcome == 'success' }}
uses: peaceiris/actions-gh-pages@de7ea6f8efb354206b205ef54722213d99067935
with:
# This `PUBLISH_DOCS_TOKEN` needs to be manually set per-repository.
# Look in the repository settings under "Environments", and set this token in the `github-pages` environment.
personal_token: ${{ secrets.PUBLISH_DOCS_TOKEN }}
# A policy must be registered for this repo and workflow

@mcmire mcmire Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't added a policy for this repo, so with this change, the docs publishing workflow will no longer work. I'm okay with this considering this repo is just a template, but I can add it if we feel that seeing an X when viewing history for this repo would be confusing. Or maybe we can add a conditional around this workflow so that it doesn't run for template repos?

@Mrtenz Mrtenz Sep 1, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we make it exit with code 0 if it fails to get a token?

@mcmire mcmire Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the get-token action fails, wouldn't it cause the workflow to fail too?

@Mrtenz Mrtenz Sep 1, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, that's why I'm suggesting we add an exit 0 step if the get-token step failed 😅

@mcmire mcmire Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah sorry I misread your comment 😅

Yeah, that makes sense. I forgot that sometimes teams don't want to publish docs for their library, and if that's the case they shouldn't be penalized for it.

What do you think about something like this? 63173fb

@Mrtenz Mrtenz Sep 1, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

# within the Token Exchange Service.
personal_token: ${{ steps.get-token.outputs.token }}
publish_dir: ./docs
destination_dir: ${{ inputs.destination_dir }}
- name: Show warning if the get-token step failed
if: ${{ steps.get-token.outcome == 'failure' }}
run: |
echo "::warning::The docs publishing workflow failed because the required token could not be obtained. If you want to publish docs for this repo, you'll need to add a policy to the Token Exchange Service."
Comment thread
cursor[bot] marked this conversation as resolved.
3 changes: 1 addition & 2 deletions .github/workflows/publish-main-docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,7 @@ jobs:
name: Publish docs to `staging` directory of `gh-pages` branch
permissions:
contents: write
id-token: write
uses: ./.github/workflows/publish-docs.yml
with:
destination_dir: staging
secrets:
PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }}
3 changes: 1 addition & 2 deletions .github/workflows/publish-rc-docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,9 +26,8 @@ jobs:
name: Publish docs to `rc-${{ needs.get-release-version.outputs.release-version }}` directory of `gh-pages` branch
permissions:
contents: write
id-token: write
uses: ./.github/workflows/publish-docs.yml
needs: get-release-version
with:
destination_dir: rc-${{ needs.get-release-version.outputs.release-version }}
secrets:
PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }}
8 changes: 2 additions & 6 deletions .github/workflows/publish-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,6 @@ on:
required: false
SLACK_WEBHOOK_URL:
required: true
PUBLISH_DOCS_TOKEN:
required: true

permissions:
contents: read
Expand Down Expand Up @@ -114,22 +112,20 @@ jobs:
needs: get-release-version
permissions:
contents: write
id-token: write
uses: ./.github/workflows/publish-docs.yml
with:
destination_dir: ${{ needs.get-release-version.outputs.RELEASE_VERSION }}
secrets:
PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }}

publish-release-to-latest-gh-pages:
name: Publish docs to `latest` directory of `gh-pages` branch
needs: publish-npm
permissions:
contents: write
id-token: write
uses: ./.github/workflows/publish-docs.yml
with:
destination_dir: latest
secrets:
PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }}

publish-release:
name: Publish to GitHub
Expand Down