access to manuscript files

[thorowitz]

I have made my manuscript repository private. An unintended side effect is that the collaborators whom I have authorized to access the repository cannot see the manuscript files (e.g., manuscript.docx, manuscript.pdf) in the output branch; they see only the read.me file. Is there a way to give them access to the manuscript files?

[agitter]

Does your private build still push the manuscript files to the gh-pages branch? One thought is that you could keep the default behavior of pushing to gh-pages, disable GitHub Pages in the repository settings, and refer your collaborators to the gh-pages branch (e.g. https://github.com/manubot/rootstock/tree/gh-pages) to view the manuscript PDF.

When we discussed this option in greenelab/meta-review#138 (comment), @dhimmel proposed creating an empty branch like gh-pages-blank and telling GitHub Pages to deploy that branch. That hasn't been tested extensively.

[thorowitz]

The pdf file gets pushed to gh-pages, but when my collaborator tries to access it, she gets a site not found error.

[agitter]

Can the collaborator access some branches in the private repo but not others? If the name of your private repository is my-manuscript, is she able to view https://github.com/thorowitz/my-manuscript? And if that works, can she use the branch switching menu to change to gh-pages and view https://github.com/thorowitz/my-manuscript/tree/gh-pages, or is that where the site not found error appears?

[thorowitz]

She can view https://github.com/thorowitz/my-manuscript/tree/gh-pages. When she clicks on https://github.com/thorowitz/my-manuscript/tree/gh-pages/manuscript.pdf, she gets the site not found error.

[agitter]

Interesting. Maybe the symbolic links don't work the same way in private repositories? The manuscript.pdf in the gh-pages branch is a symbolic link to the latest PDF. And the latest PDF is itself pointing to a versioned manuscript in a v/commit subdirectory.

I haven't used Manubot with a private repository, so I'm not sure what's happening. Would you be willing to temporarily give me read access to your private repo so I can investigate?

[thorowitz]

OK, I invited you to be a contributor. On July 25, 2020 at 8:57:04 AM, Anthony Gitter ([email protected]) wrote: Interesting. Maybe the symbolic links don't work the same way in private repositories? The manuscript.pdf in the gh-pages branch is a symbolic link to the latest PDF. And the latest PDF is itself pointing to a versioned manuscript in a v/commit subdirectory. I haven't used Manubot with a private repository, so I'm not sure what's happening. Would you be willing to temporarily give me read access to your private repo so I can investigate? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[dhimmel]

She can view https://github.com/thorowitz/my-manuscript/tree/gh-pages

That is surprising to me that someone who isn't a collaborator on a private repo would be able to see the source for a branch. I would expect the same access control to apply to all branches equally. Either you can see all branches or none.

GitHub Pages will still serve gh-pages branches on private repositories. Is is possible the collaborator was viewing the rendered manuscript via the GitHub Pages website at http://thorowitz.github.io/my-manuscript? Now I am not sure why this link doesn't currently work... possibly you deleting the repo, disabled GitHub Pages, or GitHub Pages never activated?

[agitter]

OK, I invited you to be a contributor.

I didn't receive an invite at my email address associated with GitHub username agitter.

[thorowitz]

Sorry, I was using your email! On July 26, 2020 at 8:39:31 AM, Anthony Gitter ([email protected]) wrote: OK, I invited you to be a contributor. I didn't receive an invite at my email address associated with GitHub username agitter. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[agitter]

I got the invite. I'm able to see the generated manuscript PDF as expected. I'll redact the private repo name in links below.

https://github.com/thorowitz/<redacted>/tree/gh-pages shows

Clicking the highlighted manuscript.pdf takes me to https://github.com/thorowitz/<redacted>/blob/gh-pages/manuscript.pdf where I can see the rendered 170 KB PDF that was generated July 23, 2020. That should be the easiest way for your collaborator to read the paper.

https://thorowitz.github.io/<redacted>/ and https://thorowitz.github.io/<redacted>/manuscript.pdf do give a 404 error.

Maybe the collaborator is not currently signed in to GitHub? If I sign out, I do get the GitHub 404 error from https://github.com/thorowitz/<redacted>/blob/gh-pages/manuscript.pdf

[thorowitz]

She double checked that she was logged in.

[agitter]

In that case, I'm perplexed. If she is logged in and has the same collaborator permissions that I do on that repository, she should be able to access the same files that I can. Because I'm able to see the files in the gh-pages branch, I don't believe it is a Manubot issue. You may need help from GitHub support to investigate the permissions problems she is having.

[thorowitz]

Thanks!

[thorowitz]

(shrug)