Publishing a GitHub release & triggering another workflow

[bdubaut]

Hi, I'm using semantic release in my CI pipeline (GitHub Actions), which looks like this.

The Bump version job uses semantic release to (amongst other things) generate a GitHub release after tagging.

The problem is that I want to trigger another workflow based on a new Release being published and this does not trigger, although the workflow is setup this way:

name: Release
on:
  release:
    types: [published]
jobs:
  build_docker:
    name: Build and push docker image
    runs-on: ubuntu-latest
    steps:
      # rest of the job

What am I doing wrong? Am I correct to assume that semantic release publishing a GitHub release should emit the release:published event?

[gr2m]

you need to use a token other than GITHUB_TOKEN when creating the release on GitHub. GitHub actions do not trigger other GitHub actions to avoid infinite loops. I usually create a bot user account for this use case, and save a personal access token in the org/repo secrets. But you can also register a GitHub App and then create an installation access token and pass that to semantic-release. There are actions to do that, e.g. https://github.com/marketplace/actions/action-github-app-token

[gr2m]

I use a similar setup in a lot of projects, I don't think it's a problem with semantic release. Is the repo public? If it's not, I'd ask support at https://support.github.com/contact

[qauff]

Thanks @gr2m! I'll contact Github!

[levibostian]

Putting a comment here for anyone who stumbles across this discussion looking for help...

I had the same issue as @qauff. I was noticing that when I ran semantic-release with the @semantic-release/git plugin to make a commit on deployment:

1. The actual commit being made was authored by the semantic-release user account. Not the GitHub actions bot account. This was what I expected.
2. When I would go back to my "feed" of GitHub by logging into GitHub and going to github.com, my timeline told me that the github-actions GitHub account pushed those commits to my repository. That's where I believed the issue was coming from.

I fixed the issue with:

name: Deploy action 
on:
  push:
    branches:
      - main
      - beta
      - alpha

jobs:
  deploy:
    name: Deploy git tag
    runs-on: ubuntu-latest
    steps:
      # To make git commits made by semantic-release be made to our bot and not "github-actions" user which doesn't trigger other Action Workflows. 
      # https://github.com/semantic-release/semantic-release/blob/2c30e268f9484adeb2b9d0bdf52c1cd909779d64/docs/recipes/ci-configurations/github-actions.md#pushing-packagejson-changes-to-a-master-branch
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
          persist-credentials: false # <----- makes `github-actions` user account no longer push my commits. 
      - name: Deploy via semantic release 
        uses: cycjimmy/semantic-release-action@v2
        with: 
          semantic_version: 18
        env:
          GITHUB_TOKEN: ${{ secrets.BOT_PUSH_TOKEN }}

[twinh]

Putting a comment here for anyone who stumbles across this discussion looking for help...

I had the same issue as @qauff. I was noticing that when I ran semantic-release with the @semantic-release/git plugin to make a commit on deployment:

1. The actual commit being made was authored by the semantic-release user account. Not the GitHub actions bot account. This was what I expected.
2. When I would go back to my "feed" of GitHub by logging into GitHub and going to github.com, my timeline told me that the github-actions GitHub account pushed those commits to my repository. That's where I believed the issue was coming from.

I fixed the issue with:

name: Deploy action 
on:
  push:
    branches:
      - main
      - beta
      - alpha

jobs:
  deploy:
    name: Deploy git tag
    runs-on: ubuntu-latest
    steps:
      # To make git commits made by semantic-release be made to our bot and not "github-actions" user which doesn't trigger other Action Workflows. 
      # https://github.com/semantic-release/semantic-release/blob/2c30e268f9484adeb2b9d0bdf52c1cd909779d64/docs/recipes/ci-configurations/github-actions.md#pushing-packagejson-changes-to-a-master-branch
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
          persist-credentials: false # <----- makes `github-actions` user account no longer push my commits. 
      - name: Deploy via semantic release 
        uses: cycjimmy/semantic-release-action@v2
        with: 
          semantic_version: 18
        env:
          GITHUB_TOKEN: ${{ secrets.BOT_PUSH_TOKEN }}

It works!

another option is to use your token in checkout step, instead of the semantic-release step.

- uses: actions/checkout@v2
        with:
          fetch-depth: 0
          token: ${{ secrets.PAT }}

[jensneuhaus]

Hey, thanks a lot @levibostian !! I had the same problem (Tags pushed; but it did not trigger a separated deployment Action) and now with persist-credentials it works for me!

[pmaoui]

Thank you @levibostian, I've been stuck for a long time on this one.

[Idan-Fishman]

Hey guys, is it possible to use GitHub App for this kind of job, instead of Personal Access Token?

[levibostian]

I am assuming that you're asking if you can create a private github app that is used to generate personal access tokens to use to execute semantic-release? Compared to a public github app that semantic-release maintainers maintain.

I have made a private github app before to generate personal access tokens. Best documentation that I have found is here on how to do that.

If you're looking for some example code, I use this technique in a couple projects of mine.

[Idan-Fishman]

Hello, thank you. I couldn't understand which permissions the GitHub App needs to have in order to trigger the following workflows.

For example, I have two workflows:
release.yaml, which runs the semantic release and pushes a tag.
deploy.yaml, which builds and pushes a Docker image.

[Idan-Fishman]

One more question here is which scopes does the GitHubApp or Personal Access Token needs to have inorder to be able to trigger the next workflow

[Shereef]

This is what I am using and it's not working

https://github.com/Shereef/semantic-gha-trigger-tag here is my repo

idk why it's not working

[Shereef]

@levibostian @gr2m and anyone else

https://github.com/Shereef/semantic-gha-trigger-tag here is my repo

idk why it's not working

Please help!