Repository navigation
ci: push release tags with the automation token - #357
Merged
Merged
Conversation
actions/checkout persists GITHUB_TOKEN as an http.extraheader, and git sends that header instead of the credentials in the tag push URL. The v0.33.0 tag was therefore pushed with GITHUB_TOKEN, and pushes made with GITHUB_TOKEN don't trigger other workflows, so release.yml never ran. Don't persist credentials on checkout, so the tag push authenticates with PULUMI_PROVIDER_AUTOMATION_TOKEN. semantic-release builds its own authenticated URL from GITHUB_TOKEN, so it doesn't need them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Does the PR have any schema changes?Looking good! No breaking changes found. Maintainer note: consult the runbook for dealing with any breaking changes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
equinix-tag-releaseworkflow created thev0.33.0tag, but the tag push didn't triggerrelease.yml.actions/checkoutpersistsGITHUB_TOKEN(defaultpersist-credentials: true) as anhttp.https://github.com/.extraheaderAUTHORIZATIONheader, and git sends that header instead of the credentials in the push URL. So the tag was pushed withGITHUB_TOKENrather thanPULUMI_PROVIDER_AUTOMATION_TOKEN, and events triggered byGITHUB_TOKENdon't start other workflows.This sets
persist-credentials: falseon the checkout, so the push authenticates with the automation token from the push URL. semantic-release's dry run is unaffected: it builds its own authenticated URL from theGITHUB_TOKENin its environment. It also keeps the automation token out of the git config, so the semantic-release step (which installs packages from npm at runtime) can't read it.After merging
release.ymlonly runs on tag pushes, sov0.33.0needs to be pushed again to trigger it: either delete the remote tag and push it from a user account, or delete it and re-runequinix-tag-release.🤖 Generated with Claude Code