MAINT: consolidate GPU workflow config, bump download-artifact to v21

[mmcky]

Consolidates five open PRs into three commits. #51, #52 and #53 all rewrite the same few lines of ci.yml and collab.yml and conflict pairwise, so landing them separately would have needed two careful conflict resolutions where a careless "take theirs" silently drops spot=false. Doing it in one commit resolves that region once.

What changes

	Change	Replaces
1	runs-on: disk=large → volume=80gb, plus spot=false, on all four GPU workflows	#51, #52
1	Explicit permissions: blocks so the default token can drop to read	#53
2	dawidd6/action-download-artifact → @v21 at all four call sites	#50
3	-n added to the ci.yml PDF build	#25 (partial)

The four runs-on strings now match lecture-jax and lecture-python.myst byte for byte, allowing for collab.yml's different image (ubuntu24-gpu-x64).

Notes on the judgement calls

actions: read on ci.yml and collab.yml. #53 declared this only on publish.yml, though all three run dawidd6/action-download-artifact. It turns out not to be load-bearing: lecture-jax's ci.yml runs that action green with contents: read and pull-requests: write alone, because public-repo tokens can read Actions data without the explicit scope. Added anyway — it is strictly additive, keeps the three files consistent, and removes the reliance on that behaviour.

v21 rather than dependabot's v14. v21 has roughly three months of soak against v14's one day, runs on node24 so it clears the Node 20 deprecation warning that v14 keeps, and is what lecture-jax already runs. The input surface this repo uses — workflow, branch, name, path — is unchanged across v3, v9, v14 and v21. One real behaviour change: allow_forks defaulted true in v3 and false from v9 on, so collab.yml does change. It is inert here because the step pins branch: main against an upstream workflow, so the runs being searched are never fork runs.

The -n flag. ci.yml's PDF build was the only jb build in that file without -n, while publish.yml runs the same pdflatex build with -n -W. That gap let a bad cross-reference or missing citation pass the PR check and then fail the tag-only publish build. cache.yml also builds HTML without -n; left alone deliberately, since that workflow is currently failing and tightening it is a separate change.

What this does not fix

CI stays red. Both repo-wide breakages are untouched by this PR and are being handled separately: the stale PyTorch nightly index in ci.yml's install step, and cache.yml being both auto-disabled for inactivity and failing during notebook execution, so the build-cache artifact every other workflow downloads has never existed.

Part of the rollout tracked in QuantEcon/meta#330, with the permissions work from QuantEcon/meta#347.

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for timely-seahorse-68815c ready!

Name	Link
🔨 Latest commit	5901428
🔍 Latest deploy log	https://app.netlify.com/projects/timely-seahorse-68815c/deploys/6a72a73b4dd2e00008499107
😎 Deploy Preview	https://deploy-preview-54--timely-seahorse-68815c.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Pull request overview

This PR consolidates several workflow maintenance changes to standardize GPU runner configuration, tighten GitHub Actions token permissions, and modernize artifact download usage across the repository’s CI workflows.

Changes:

• Standardize GPU runs-on labels across workflows (volume=80gb + spot=false).
• Add explicit permissions: blocks (workflow/job level) to support lowering default GITHUB_TOKEN permissions.
• Bump dawidd6/action-download-artifact call sites to @v21 and add -n to the ci.yml PDF build.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/publish.yml	Adds workflow-level permissions, updates GPU runner label, and bumps artifact download action to v21.
.github/workflows/linkcheck.yml	Bumps artifact download action to v21 (permissions likely need tightening too).
.github/workflows/collab.yml	Updates GPU runner label, adds job permissions, and bumps artifact download action to v21.
.github/workflows/ci.yml	Updates GPU runner label, adds job permissions, bumps artifact download action to v21, and makes PDF build nitpicky (-n).
.github/workflows/cache.yml	Updates GPU runner label for the cache workflow.

Suppressed comments (1)

.github/workflows/cache.yml:13

• actions/checkout is pinned to github.event.pull_request.head.sha, but this workflow only runs on schedule and workflow_dispatch (no pull_request payload). On those events the expression resolves to empty/undefined and can cause checkout to fail or fetch the wrong ref. Prefer default checkout behavior (or use github.sha) for scheduled/manual runs.

    runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false"
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.