Running "dvc pull" now requires authentication

[seisman]

The Contributors' guides (https://www.pygmt.org/dev/contributing.html#using-data-version-control-dvc-to-manage-test-images) mention that:

To pull or sync files from the dvc remote to your local repository, use the commands below.

dvc status  # should report any files 'not_in_cache'
dvc pull  # pull down files from DVC remote cache (fetch + checkout)

To push or sync changes from your local repository up to the dvc remote at DAGsHub, you will first need to set up authentication using the commands below.

dvc remote modify upstream --local auth basic
dvc remote modify upstream --local user "$DAGSHUB_USER"
dvc remote modify upstream --local password "$DAGSHUB_PASS"

So, previously, authentication is not required when running dvc pull, but is required for dvc push. It makes sense for a public DVC repository like pygmt or gmt.

However, it appears that dvc pull requires authentication recently, which causes issues such as #4078 and creates additional barriers for contributors (e.g.,
GenericMappingTools/gmt#8807 and #4135 (review)).

It's unclear if the authentication changes are intentional or not.

[joa-quim]

So, this is why the GMT tests are all failing now.

[seisman]

So, this is why the GMT tests are all failing now.

The GMT CI already work as expected after my fix in GenericMappingTools/gmt#8799.

[joa-quim]

I'll have to confirm it though, because I think I saw total failures (related to DVC) more recent than that fix.

[joa-quim]

Yep, #8804 was where I saw:

[seisman]

In CI, we use a DagsHub token to pull baseline images from DagsHub, but it seems the token can't be used in PRs from forks.

[joa-quim]

Ah, not ideal but OK.

[weiji14]

it seems the token can't be used in PRs from forks.

From https://2i2c.org/blog/2025/github-action-secrets-forked-repositories (2i2c-org/2i2c-org.github.io#503), it sounds like there are two options:

1. Use pull_request_target (not secure)
2. Use GitHub environments to allow forks to access non-critical secrets

Let's go with 2 I think, see executablebooks/github-activity#134 for an example implementation, where environment: pr-tests is set in the GitHub Actions.