Context
The deploy-token input is presented as a required "GitHub token for deployment to GitHub Pages" in the action
metadata and the docs. In reality it is never consumed — the gh-pages push authenticates via the caller's
actions/checkout credentials (full analysis in #26).
Problem / Current Behaviour
The description and docs misrepresent what the token does. They imply deploy-token is what authenticates the
deploy and that a dedicated PAT (secrets.ACTIONS_DEPLOY_TOKEN) will be used. Both are false: the value is set
into an env var that no command reads, and auth comes from the checkout token (which needs contents: write).
This misleads consumers into thinking wiring deploy-token is sufficient and into passing a PAT that is ignored.
Affected locations
| File |
Symbol |
Current (misleading) text |
actions/mkdocs-deploy/action.yml |
inputs.deploy-token description (lines 52-55) |
"GitHub token for deployment to GitHub Pages. ... Example: secrets.ACTIONS_DEPLOY_TOKEN." |
docs/mkdocs-deploy.md |
Inputs table (line 33) |
"deploy-token | GitHub token for deployment | Yes | -" |
docs/reference/mkdocs-deploy.md |
Inputs table (line 31) + usage snippet (line 14) |
"deploy-token | GitHub token for deployment | Yes | -" |
Proposed Solution
Update the wording to reflect reality, consistent with how #26 is resolved:
Either way, stop implying an unused input authenticates the deploy.
Out of Scope
Effort Estimate
Size: XS — description + two docs tables (and the reference usage snippet).
Definition of Done
Related
Context
The
deploy-tokeninput is presented as a required "GitHub token for deployment to GitHub Pages" in the actionmetadata and the docs. In reality it is never consumed — the
gh-pagespush authenticates via the caller'sactions/checkoutcredentials (full analysis in #26).Problem / Current Behaviour
The description and docs misrepresent what the token does. They imply
deploy-tokenis what authenticates thedeploy and that a dedicated PAT (
secrets.ACTIONS_DEPLOY_TOKEN) will be used. Both are false: the value is setinto an env var that no command reads, and auth comes from the checkout token (which needs
contents: write).This misleads consumers into thinking wiring
deploy-tokenis sufficient and into passing a PAT that is ignored.Affected locations
actions/mkdocs-deploy/action.ymlinputs.deploy-tokendescription (lines 52-55)docs/mkdocs-deploy.mddeploy-token| GitHub token for deployment | Yes | -"docs/reference/mkdocs-deploy.mddeploy-token| GitHub token for deployment | Yes | -"Proposed Solution
Update the wording to reflect reality, consistent with how #26 is resolved:
deploy-tokenauthenticates thegh-pagespush andneeds
contents: write(andpageswhere applicable), and that it is genuinely used.deploy-tokenfrom the description/tables and document thatthe deploy uses the caller's
actions/checkoutcredentials (persist-credentials: true, token withcontents: write).Either way, stop implying an unused input authenticates the deploy.
Out of Scope
Effort Estimate
Size:
XS— description + two docs tables (and the reference usage snippet).Definition of Done
deploy-tokeninput description and both docs tables accurately describe the token's role (or its removal),consistent with the resolution of bug(mkdocs-deploy): deploy-token / ACTIONS_DEPLOY_TOKEN is never used — the push relies on checkout credentials #26.
Related