Publishing a GitHub release & triggering another workflow #1906

bdubaut · 2021-04-24T06:30:15Z

bdubaut
Apr 24, 2021

Hi, I'm using semantic release in my CI pipeline (GitHub Actions), which looks like this.

The Bump version job uses semantic release to (amongst other things) generate a GitHub release after tagging.

The problem is that I want to trigger another workflow based on a new Release being published and this does not trigger, although the workflow is setup this way:

name: Release
on:
  release:
    types: [published]
jobs:
  build_docker:
    name: Build and push docker image
    runs-on: ubuntu-latest
    steps:
      # rest of the job

What am I doing wrong? Am I correct to assume that semantic release publishing a GitHub release should emit the release:published event?

Answered by gr2m

Apr 25, 2021

you need to use a token other than GITHUB_TOKEN when creating the release on GitHub. GitHub actions do not trigger other GitHub actions to avoid infinite loops. I usually create a bot user account for this use case, and save a personal access token in the org/repo secrets. But you can also register a GitHub App and then create an installation access token and pass that to semantic-release. There are actions to do that, e.g. https://github.com/marketplace/actions/action-github-app-token

View full answer

gr2m · 2021-04-25T21:06:28Z

gr2m
Apr 25, 2021
Maintainer

you need to use a token other than GITHUB_TOKEN when creating the release on GitHub. GitHub actions do not trigger other GitHub actions to avoid infinite loops. I usually create a bot user account for this use case, and save a personal access token in the org/repo secrets. But you can also register a GitHub App and then create an installation access token and pass that to semantic-release. There are actions to do that, e.g. https://github.com/marketplace/actions/action-github-app-token

9 replies

gr2m Oct 20, 2021
Maintainer

I use a similar setup in a lot of projects, I don't think it's a problem with semantic release. Is the repo public? If it's not, I'd ask support at https://support.github.com/contact

englut Oct 20, 2021

Thanks @gr2m! I'll contact Github!

levibostian Jan 18, 2022

Putting a comment here for anyone who stumbles across this discussion looking for help...

I had the same issue as @qauff. I was noticing that when I ran semantic-release with the @semantic-release/git plugin to make a commit on deployment:

The actual commit being made was authored by the semantic-release user account. Not the GitHub actions bot account. This was what I expected.
When I would go back to my "feed" of GitHub by logging into GitHub and going to github.com, my timeline told me that the github-actions GitHub account pushed those commits to my repository. That's where I believed the issue was coming from.

I fixed the issue with:

name: Deploy action 
on:
  push:
    branches:
      - main
      - beta
      - alpha

jobs:
  deploy:
    name: Deploy git tag
    runs-on: ubuntu-latest
    steps:
      # To make git commits made by semantic-release be made to our bot and not "github-actions" user which doesn't trigger other Action Workflows. 
      # https://github.com/semantic-release/semantic-release/blob/2c30e268f9484adeb2b9d0bdf52c1cd909779d64/docs/recipes/ci-configurations/github-actions.md#pushing-packagejson-changes-to-a-master-branch
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
          persist-credentials: false # <----- makes `github-actions` user account no longer push my commits. 
      - name: Deploy via semantic release 
        uses: cycjimmy/semantic-release-action@v2
        with: 
          semantic_version: 18
        env:
          GITHUB_TOKEN: ${{ secrets.BOT_PUSH_TOKEN }}

twinh Apr 21, 2022

Putting a comment here for anyone who stumbles across this discussion looking for help...

I had the same issue as @qauff. I was noticing that when I ran semantic-release with the @semantic-release/git plugin to make a commit on deployment:

The actual commit being made was authored by the semantic-release user account. Not the GitHub actions bot account. This was what I expected.

When I would go back to my "feed" of GitHub by logging into GitHub and going to github.com, my timeline told me that the github-actions GitHub account pushed those commits to my repository. That's where I believed the issue was coming from.

I fixed the issue with:
name: Deploy action 
on:
  push:
    branches:
      - main
      - beta
      - alpha

jobs:
  deploy:
    name: Deploy git tag
    runs-on: ubuntu-latest
    steps:
      # To make git commits made by semantic-release be made to our bot and not "github-actions" user which doesn't trigger other Action Workflows. 
      # https://github.com/semantic-release/semantic-release/blob/2c30e268f9484adeb2b9d0bdf52c1cd909779d64/docs/recipes/ci-configurations/github-actions.md#pushing-packagejson-changes-to-a-master-branch
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
          persist-credentials: false # <----- makes `github-actions` user account no longer push my commits. 
      - name: Deploy via semantic release 
        uses: cycjimmy/semantic-release-action@v2
        with: 
          semantic_version: 18
        env:
          GITHUB_TOKEN: ${{ secrets.BOT_PUSH_TOKEN }}

It works!

another option is to use your token in checkout step, instead of the semantic-release step.

- uses: actions/checkout@v2
        with:
          fetch-depth: 0
          token: ${{ secrets.PAT }}

jensneuhaus May 24, 2022

Hey, thanks a lot @levibostian !! I had the same problem (Tags pushed; but it did not trigger a separated deployment Action) and now with persist-credentials it works for me!

pmaoui · 2023-11-29T15:50:59Z

pmaoui
Nov 29, 2023

Thank you @levibostian, I've been stuck for a long time on this one.

0 replies

idanfishman · 2024-01-10T17:27:38Z

idanfishman
Jan 10, 2024

Hey guys, is it possible to use GitHub App for this kind of job, instead of Personal Access Token?

2 replies

levibostian Jan 10, 2024

I am assuming that you're asking if you can create a private github app that is used to generate personal access tokens to use to execute semantic-release? Compared to a public github app that semantic-release maintainers maintain.

I have made a private github app before to generate personal access tokens. Best documentation that I have found is here on how to do that.

If you're looking for some example code, I use this technique in a couple projects of mine.

idanfishman Jan 10, 2024

Hello, thank you. I couldn't understand which permissions the GitHub App needs to have in order to trigger the following workflows.

For example, I have two workflows:
release.yaml, which runs the semantic release and pushes a tag.
deploy.yaml, which builds and pushes a Docker image.