Repository navigation
Running "dvc pull" now requires authentication #4147
Description
The Contributors' guides (https://www.pygmt.org/dev/contributing.html#using-data-version-control-dvc-to-manage-test-images) mention that:
To pull or sync files from the dvc remote to your local repository, use the commands below.
dvc status # should report any files 'not_in_cache' dvc pull # pull down files from DVC remote cache (fetch + checkout)
To push or sync changes from your local repository up to the dvc remote at DAGsHub, you will first need to set up authentication using the commands below.
dvc remote modify upstream --local auth basic dvc remote modify upstream --local user "$DAGSHUB_USER" dvc remote modify upstream --local password "$DAGSHUB_PASS"
So, previously, authentication is not required when running dvc pull, but is required for dvc push. It makes sense for a public DVC repository like pygmt or gmt.
However, it appears that dvc pull requires authentication recently, which causes issues such as #4078 and creates additional barriers for contributors (e.g.,
GenericMappingTools/gmt#8807 and #4135 (review)).
It's unclear if the authentication changes are intentional or not.
Activity
joa-quim commentedon Oct 9, 2025
seisman commentedon Oct 9, 2025
joa-quim commentedon Oct 9, 2025
joa-quim commentedon Oct 9, 2025
seisman commentedon Oct 9, 2025
In CI, we use a DagsHub token to pull baseline images from DagsHub, but it seems the token can't be used in PRs from forks.
joa-quim commentedon Oct 9, 2025
weiji14 commentedon Oct 10, 2025
From https://2i2c.org/blog/2025/github-action-secrets-forked-repositories (2i2c-org/2i2c-org.github.io#503), it sounds like there are two options:
pull_request_target(not secure)Let's go with 2 I think, see executablebooks/github-activity#134 for an example implementation, where
environment: pr-testsis set in the GitHub Actions.weiji14 commentedon Oct 13, 2025
Option 3 from @seisman in #4148 (comment)
seisman commentedon Oct 14, 2025
Maybe it's a DagsHub bug? PyGMT on DagsHub is a public repository. I see no reason why authentication is required for
dvc pulloperation.weiji14 commentedon Oct 14, 2025
Yeah, it's weird because I also need to log in now to see https://dagshub.com/GenericMappingTools/pygmt, though the repo should be public according to the settings. Not sure where we can report this.
weiji14 commentedon Mar 19, 2026
FYI, the noisy deployment messages we saw in #4148 can be turned off now if I'm correctly reading https://github.blog/changelog/2026-03-19-github-actions-late-march-2026-updates/#github-actions-now-allows-developers-to-use-environments-without-auto-deployment, so we could potentially revisit option 2. Or if we're happy with the cache implementation (option 3), maybe ok to close this?
seisman commentedon Mar 20, 2026
Yes, revisiting option 2 sounds good.
weiji14 commentedon Mar 20, 2026
Ok, let me revert the reverted PR 😆
weiji14 commentedon Mar 24, 2026
To summarize from #4462 (comment), Option 2 still doesn't work without using
pull_request_targettrigger (which we decided against for security reasons). But ok to keep #4457 for now.seisman commentedon Jul 21, 2026
No longer an issue after #4738. Closing.