Fix broken build process - implement nox?

[kelle]

The website is currently not building successfully. It likely needs some significant attention in order to fix.

One big problem: notebooks have competing requirements.

Proposal: each notebook needs it’s own requirements.txt and environment. compile the notebooks. and then keep the HTML build. Possible tool = nox .

[jeffjennings]

The build.yml workflow is now failing due to 'Bad credentials' - I'm guessing the secrets.DISPATCH_GITHUB_TOKEN in this repo expired and needs to be re-generated. I don't have permissions to edit the repo secrets so can't do this - @kelle or @adrn, could you?

[adrn]

I don't have admin access to the repo so I can't control secrets. @pllim ?

[pllim]

I don't use nox . Where are the instructions to regenerate such a token? Thanks!

[jeffjennings]

To generate a new token, from the repo on github, go to 'Settings' at the top of the page, then 'Secrets and Variables' in the left panel, then 'Actions' --> 'New repository secret'; name it DISPATCH_GITHUB_TOKEN. For the secret value (the token), I'm not sure how astropy handles token permissions, but in general what's needed is a personal access token as described here. I think it needs to have read/write access in both the astropy-tutorials repo and the learn-astropy repo.

[jeffjennings]

Just to note here in response to Kelle's question about using nox; we're instead setting up the environment for each notebook using the Makefile.

[pllim]

Re: token -- I need time to investigate if fine grained PAT is even possible in org level but not sure when. Has this workflow ever succeeded before? If yes, how did you set it up prior?

[jeffjennings]

There might be a different way it's done in astropy, sorry I'm not sure. The workflow did succeed >1 year ago, but I think a former contractor may have set it up, or maybe @kelle knows more.

[pllim]

https://github.com/peter-evans/repository-dispatch?tab=readme-ov-file#token says fine grained PAT is still in "beta" but we can try if you can confirm this is how you really want to proceed.

[jeffjennings]

Ok yes it looks like a fine-grained PAT is what github recommends (even though it's in beta), for the reason given here - "Your personal access token (classic) can access every repository that you can access. GitHub recommends that you use fine-grained personal access tokens instead, which you can restrict to specific repositories. Fine-grained personal access tokens also enable you to specify fine-grained permissions instead of broad scopes."

So if we could add a fine-grained PAT as detailed above that has read/write access in the astropy-tutorials repo and the learn-astropy repo, I think the github actions workflow that builds and deploys the tutorials will then succeed.

[pllim]

@jeffjennings , maybe you can play around with that over at the CCA org first because I cannot figure out how to do this for Astropy org. I can only create PAT from my own account, but from there, I cannot specific Astropy org repos. The docs I can find are not very clear on this. Please let me know if you have success. Thanks!

[kelle]

I've made a token and DM'd you both in Slack.

[jeffjennings]

For future reference, the Dispatch Learn Astropy step in the build workflow was failing, probably because the token used there expired. It now passes after Kelle created a new fine-grained personal access token with write/read access to the contents and metadata of this repo and astropy-learn, following the instructions here and the guide here.

I've set #606 to close this issue, as that solves the other problem Kelle mentions at the top - individual notebooks can have competing (version) dependencies.