Skip to content

Fix invalid YAML indentation in mirror workflow - #112

Open
ehavazli wants to merge 3 commits into
mainfrom
fix/mirror-workflow-yaml
Open

Fix invalid YAML indentation in mirror workflow#112
ehavazli wants to merge 3 commits into
mainfrom
fix/mirror-workflow-yaml

Conversation

@ehavazli

Copy link
Copy Markdown
Collaborator

Summary

  • Non-breaking spaces (U+00A0) had crept into the indentation of .github/workflows/mirror.yml, causing GitHub Actions to reject it as invalid YAML.
  • Replaced with regular spaces; file now parses correctly.

Test plan

  • Validated with python3 -c "import yaml; yaml.safe_load(open('.github/workflows/mirror.yml'))"

Non-breaking spaces had crept into the indentation, breaking the YAML parser.
github.com/nisar-science-algorithms redirects to the renamed
NISAR-Science-Algorithms org, adding an extra hop on every push.
@ehavazli

ehavazli commented Aug 28, 2026

Copy link
Copy Markdown
Collaborator Author

@katia-tymofyeyeva @EJFielding
This PR fixes the YAML syntax error (non-breaking spaces in indentation) and updates the destination URL casing, but two remaining CI failures are credential/token issues outside the scope of this fix — they need to be resolved by whoever owns the secrets:

  1. NISAR_TOKEN (used in mirror.yml): GitHub rejects the mirror push for every branch with refusing to allow a Personal Access Token to create or update workflow .github/workflows/gitlab_sync.yml without workflow scope. The PAT needs to be regenerated with the workflow scope (classic PAT) or Workflows: Read and write permission (fine-grained PAT), then the NISAR_TOKEN secret updated.

  2. GITLAB_TOKEN (used in gitlab_sync.yml): GitLab returns HTTP Basic: Access denied — the token is invalid, expired, or improperly scoped. Needs a fresh GitLab personal access token with write_repository scope, with GITLAB_USERNAME/GITLAB_URL secrets confirmed to match that token's account.

Mirroring every branch rejected 11 of 12 pushes since the token lacks
workflow scope needed for branches whose .github/workflows differ from
the destination. Only main needs to sync to the org repo.
@ehavazli

Copy link
Copy Markdown
Collaborator Author

Update: restricting the mirror to `main` (last commit) stops the 11 feature-branch rejections, but `main` itself still fails with the same error:

```
! [remote rejected] main -> main (refusing to allow a Personal Access Token to create or update workflow .github/workflows/gitlab_sync.yml without workflow scope)
```

This confirms it's purely the `NISAR_TOKEN` scope problem noted above — `main`'s copy of `.github/workflows/gitlab_sync.yml` differs from the destination's, and GitHub blocks the push until the token has `workflow` scope (classic PAT) or `Workflows: Read and write` (fine-grained PAT). No further code change in this repo will resolve it; the secret needs to be regenerated with that scope.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant