CI: guard against reading data-lectures over the LFS media host - #830
Merged
Conversation
A dataset URL on the wrong host fails in the reader's notebook, not in CI. media.githubusercontent.com is the LFS *media* endpoint and routes per path, serving a file only where that path is LFS-tracked in the repo the URL names. Everything data-lectures publishes is plain git, so that host never resolves for it — and the datasets folded in from high_dim_data are read from it today, which means a mechanical org/repo swap that preserves the host breaks every one of them. Nothing in this repo would catch that. The data-audit dashboard that does lives in QuantEcon/data-lectures and never runs on a pull request here — its detection lag is up to seven days. This runs pre-merge, in the repo being changed, and `grep -r` also walks lectures/_static/**/*.ipynb, which the audit deliberately does not scan and this repo's build never executes. Matches zero lines today (verified: exit 1), so it goes green on merge and is armed before the fold rather than alongside it. Gate 2 of QuantEcon/workspace-lectures#23 step 3. See QuantEcon/data-lectures PLAN.md, repoint rule 6. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for taupe-gaufre-c4e660 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a lightweight GitHub Actions workflow to proactively detect any lecture content that references QuantEcon/data-lectures via the Git LFS media host (media.githubusercontent.com), which would 404 for that repo and fail only at runtime in notebooks.
Changes:
- Introduces a new workflow that greps
lectures/(including_static/**/*.ipynb) formedia.githubusercontent.com/media/QuantEcon/data-lectures. - Emits a GitHub Actions error and fails the job when a match is found; otherwise prints an OK message.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
mmcky
added a commit
that referenced
this pull request
Aug 10, 2026
* CI: least-privilege token for the data URL guard The job greps a checkout and writes nothing, but this repo's default workflow permission is `write`, so it was receiving a token that could also approve pull requests. Raised by Copilot on the wasm twin, QuantEcon/lecture-wasm#58, which carries the same one-line change; it left no inline comments on #830, so this landed here unflagged. Scoped to this workflow. cache.yml, ci.yml and collab.yml have the same gap and are left alone — linkcheck.yml, publish.yml and sync-translations-zh-cn.yml already scope theirs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gate 2 of QuantEcon/workspace-lectures#23 step 3. One new workflow, no lecture changes.
The failure it catches
media.githubusercontent.comis the LFS media endpoint. It routes per path, not per repo — it serves a file only where that path is LFS-tracked in the repo the URL names, and 404s otherwise. EverythingQuantEcon/data-lecturespublishes is plain git, so that host never resolves for it:raw.githubusercontent.com/QuantEcon/data-lectures/main/lectures/mpd2020.xlsxmedia.githubusercontent.com/media/QuantEcon/data-lectures/main/lectures/mpd2020.xlsxBoth hosts send
access-control-allow-origin: *, so this is host routing, not CORS — a different failure from repoint rule 5, and unlike rule 5 it hits CPython consumers too.This matters right now because the six
high_dim_datadatasets are LFS-tracked there, so this repo reads them from the media host today. When they land in data-lectures as plain git, a mechanical org/repo swap that preserves the host breaks every one of them.Why here, and why a separate workflow
The check that would otherwise catch it is the data-audit dashboard in
QuantEcon/data-lectures— but that workflow triggers on pushes to that repo, a weekly Monday cron, and PRs touching its paths. No event in this repo reaches it, so its detection lag after a bad repoint merges is up to seven days. This runs pre-merge, in the repo being changed.grep -roverlectures/also walkslectures/_static/**/*.ipynb. That matters: the audit deliberately excludes_static/from its scan, andlectures/_config.ymlexcludes it from execution, so_static/lecture_specific/inequality/data.ipynbis invisible to every other mechanism. This guard is the only thing that sees it.Scope and honesty about what it is
It matches zero lines today — verified,
grepexits 1 in a clean tree — so it goes green on merge and is armed before the fold rather than landing alongside it.It is a literal host-string check. It cannot see a wrong ref, a preserved source subdirectory, or a repoint that lands before the bytes do; those are asserted post-merge by the strict audit in QuantEcon/data-lectures#55. The two are complements.
And it is an alarm, not a gate:
main'srequired_status_checkshascontexts: [], so this will show as a failed check on the PR without blocking the merge. Adding it as a required context is a separate, deliberate decision.The companion assertion — that no
high_dim_dataURL remains anywhere — matches 7 lines here today, so it belongs in the repoint PR itself, not this one.🤖 Generated with Claude Code