[aliencaocao]

Purpose

The minimum-versions-publish job pushes the minimum version table to SemiAnalysisAI/ClusterMAX-web with the CLUSTERMAX_WEB_TOKEN personal access token. A long-lived token with write access to another repository is a security risk. The job has also failed on every run since 2026-10-22, so the public table is old.

This change publishes the table to the GitHub Pages site of this repository. The deploy uses the OIDC token of the run. No secret is necessary.

What changed

• .github/workflows/minimum-versions-publish.yml: replaced the cross-repository push with a GitHub Pages deploy (actions/upload-pages-artifact + actions/deploy-pages). The job runs after each minimum-versions-refresh run (workflow_run), on a push to master that changes the table, daily at 08:43 UTC as a safety net, and by hand. It has no secrets. reference.
• The Pages site carries one file only: https://semianalysisai.github.io/ClusterMAX/minimum-versions.json. A step stops the job if the site directory contains any other file.
• .github/scripts/minimum_pages.py (new) builds that file from cmax/scripts/1-audit/minimum-versions.json and adds two top-level stamps:
  • refreshed: the completion time of the latest successful minimum-versions-refresh run. It moves every day, also when no minimum changed. If the lookup fails, the script keeps the value that the site serves now. The script never sets this value older than generated.
  • changed: the generated stamp of the oldest consecutive revision of the table (from Git history) that has the current minimum values. A metadata-only change or a timestamp-only refresh does not move it.
• The job attests the published file with actions/attest-build-provenance. Anyone can verify it with gh attestation verify minimum-versions.json --repo SemiAnalysisAI/ClusterMAX.
• cmax/minimum_sync.py: the default address is now the Pages address. New refreshed_stamp(), table_refreshed() and stale_warning() functions.
• cmax/security.py: when the fetch fails, the audit grades against the cached table (the last successful fetch) if it is not older than the installed table, and against the installed table otherwise. This behavior was already present. New: when the table in use was last refreshed more than 7 days ago, the audit gives a second warning. The decision uses refreshed only (generated for a table without refreshed, for example the table inside the package). A successful fetch, a 304 Not Modified, or a rejected older publication gives no warning.
• cmax/cli.py, cmax/minimum_links.py, README.md: the Pages address and the new warning.
• .github/scripts/select_tests.py: the publish workflow and the new script now select tests/test_minimum_pages.py.

Effect

• Users: cmax audit security reads the Pages address. An offline run prints a warning when its table was last refreshed more than 7 days ago.
• Operators: after merge, remove the CLUSTERMAX_WEB_TOKEN secret and revoke the token.
• Developers: do not put other files on the Pages site.
• Data and compatibility: the table schema stays at version 1. The new changed key replaces the website-only updated key. Released clients (0.3.0 and older) read https://www.clustermax.ai/minimum-versions.json. The companion website change (ClusterMAX-web #40) makes that address serve the Pages copy.

Technical terms

• OIDC token: a short-lived identity token that GitHub Actions gives one workflow run. GitHub Pages accepts it for the deploy, so no stored secret is necessary.
• attestation: a signed record that a specified workflow run on a specified commit made a specified file.

Validation

• python3 -m pytest -q: 2196 passed.
• tests/test_minimum_pages.py (new): the changed history walk, refreshed moves without a content change, fallbacks, the completeness gate, the one-file site, and no secret in the workflow.
• tests/audit/test_minimum_sync.py::StalenessTests (new): the 7-day limit, refreshed over generated, cached and installed fallbacks, and no warning after a successful fetch or a rejected older publication.
• A local run of minimum_pages.py against master gave generated=2026-10-21T07:34:42Z changed=2026-10-21T07:34:42Z.
• git diff --check: clean.
• Not run: the Pages deploy. Pages is not enabled on this repository yet.

Merge plan

1. A repository admin enables Pages: Settings → Pages → Source: GitHub Actions. The deploy fails until then.
2. Merge this PR. The push run deploys the site.
3. Merge the website PR, ClusterMAX-web #40. It reads the Pages address and keeps its committed snapshot as the fallback, so the order of steps 2 and 3 is not important.
4. Remove the CLUSTERMAX_WEB_TOKEN secret and revoke the token.

Design decisions for approval

• Approval required: Yes.
• Decision: GitHub Pages (OIDC) instead of a cross-repository token, a release asset, or an Actions artifact.
• Options: an Actions artifact expires after 90 days at most and needs a token to download. A release asset adds an entry to the release list. A data branch needs a branch protection exception and goes through raw.githubusercontent.com caching and rate limits.
• Recommendation: GitHub Pages.
• Approver: the ClusterMAX maintainers.

Note: minimum-versions-refresh has failed at "Run the offline audit policy tests" since 2026-10-22. A failed run does not move refreshed, so until that is fixed the published refreshed stays at the last successful run (2026-10-21). An offline client starts to warn after 7 days. This is the intended signal.

Created with Perplexity