updating Version Packages PR uses GITHUB_TOKEN instead of PAT

[emilgp]

Background

We have this running in master.yml

      - id: changesets
        uses: changesets/action@master
        with:
          publish: npm run release
        env:
          GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }}
        ....

We also have a separate pull_request.yml that runs the usual lint and test status checks before it can be merged

When we used GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} before the PR action is not being triggered, so we had to use PAT. Now after a successful changeset merge it will create a new Version Packages PR and trigger the PR Action.

Problem

After a changeset merge with an existing Version Packages PR, the changes are pushed into the Version Packages PR correctly, however it is not triggering the action (git push is using GITHUB_TOKEN again)

Anyone found a way to have that git push use PAT as well?

Thanks

[Andarist]

Could you describe in more detail which part of the workflow is not using the PAT? I'm a little bit confused considering the given description.

[emilgp]

Hi @Andarist,

            feature/b 
    feature/a     \
        \          \
master --A1---------B1--
          \          \
version    A2---------B2--

A1 and B1 are where the new features are merged into master
A2 would be where a new Version Packages pull request is created
B2 is where it would merge the changes if the pull request is still open

A2 is correctly triggering GH Actions, while B2 does not (preventing status checks from passing)

Hope that made it clearer (and not worse lol)

Thanks

[Andarist]

Hah, that's a little bit strange - I would suspect that it's a problem with triggers that you have set up for your CI job. Could you paste in your .yml for that (I'm assuming that you are using GitHub Actions)? Is CI re-triggered if you do a similar scenario manually using any other branch?

[emilgp]

Yes using GH actions, master CI branch has:

on:
  push:
    branches:
      - master

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v1
        with:
          node-version: 12
          registry-url: https://npm.pkg.github.com/
      - run: npm ci
      - run: npm run lint
      - run: npm run build

      - id: changesets
        uses: changesets/action@master
        with:
          publish: npm run release
        env:
          GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }}
          NPM_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

npm run release does a npm run build && npx changeset publish

And on pull requests:

on:
  pull_request:
    branches:
      - master

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - run: npm ci
      - run: npm run lint
      - run: npm run build

On feature/* branches, this PR action runs whenever pull requests are created or updated with new commits.

On changeset-release/master branches (the Version Packages pull request) will use my PAT and trigger the action:

But the next changes from master would be pushed by github-actions bot which won't trigger the action:

[Andarist]

Wow, that's quite strange - the PRs are opened & updated using very similar logic:

action/src/run.ts

Lines 266 to 283 in b3300fa

	if (searchResult.data.items.length === 0) {
	console.log("creating pull request");
	await octokit.pulls.create({
	base: branch,
	head: versionBranch,
	title: finalPrTitle,
	body: await prBodyPromise,
	...github.context.repo,
	});
	} else {
	octokit.pulls.update({
	pull_number: searchResult.data.items[0].number,
	title: finalPrTitle,
	body: await prBodyPromise,
	...github.context.repo,
	});
	console.log("pull request found");
	}

that uses the very same Octokit instance that is created using the same token:

action/src/run.ts

Line 172 in b3300fa

let octokit = github.getOctokit(githubToken);

But actually, all commits (including the first one that "creates" a PR) are signed by a github-actions bot:

action/src/index.ts

Lines 24 to 27 in b3300fa

	await fs.writeFile(
	`${process.env.HOME}/.netrc`,
	`machine github.com\nlogin github-actions[bot]\npassword ${githubToken}`
	);

It's only the PR itself that is authored by your personal account.

One thing - could you change your CI triggers to:

on: [pull_request, push]

[emilgp]

i'd think it would still not get triggered with a push from github-actions bot. i should set up a public repo to repro this, didn't realize there's free minutes for gh actions

[ianwalter]

I'm facing this issue as well. Maybe this is a bug with GitHub Actions. Perhaps it would be better to rename GITHUB_TOKEN to something else? GitHub doesn't allow you create a secret called GITHUB_TOKEN. It says it's an "invalid name" so maybe there's a bug where the environment variable gets overwritten but only on subsequent updates to the PR.

[Andarist]

That's an interesting idea - would be great if you could test this with a different name for this env. patch-package might come in handy for this.

[ianwalter]

I was wrong. I read another issue that reminded me that we need to tell the checkout action to use the PAT as well. This looks like your issue as well @emilgp. It should look like:

      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
          token: ${{ secrets.PAT_TOKEN }}

[emilgp]

my PAT token actually stopped working, i keep getting this error after
/usr/bin/git push origin HEAD:changeset-release/master --force

UnhandledPromiseRejectionWarning: HttpError: Validation Failed: {"message":"The listed users and repositories cannot be searched either because the resources do not exist or you do not have permission to view them.","resource":"Search","field":"q","code":"invalid"}

Regenerating the token didn't help. Changed back to GITHUB_TOKEN which creates the Version Packages PR but does not trigger the PR action. Tried changing back to PAT then it worked again, so i can't tell if applying changes from @ianwalter would help.

I'm facing issues around the tokens in other actions as well, will have to see how github support figures them out.

[Andarist]

@ianwalter did switching to PAT solve your problem entirely? are workflows run even after the versioning PR gets force-pushed after a fresh merge to your main branch?

@emilgp let me know if I can be of any assistance

[JakeGinnivan]

Any action with GITHUB_TOKEN will not trigger actions. This is to stop circular triggers.

Basically if you want to do anything with GITHUB_TOKEN and have an action trigger you need to use your own PAT rather than GITHUB_TOKEN.

So if you manually merged the PR then the master workflow would run, but any pushes to the PR would not.

[ianwalter]

@ianwalter did switching to PAT solve your problem entirely? are workflows run even after the versioning PR gets force-pushed after a fresh merge to your main branch?

Yes

[Andarist]

Any action with GITHUB_TOKEN will not trigger actions. This is to stop circular triggers.

Right. I don't think this is really that developer-friendly though. There is no such guard when using other CI providers and somehow we don't end up having this problem that often 😉

[JakeGinnivan]

Yep, it is an annoying limitation. We have created a service account and generated a PAT which we put in our organisations secrets and use that for anything we need to trigger actions.

[jonrohan]

This could be addressed by allowing configuration of the git user here

action/src/gitUtils.ts

Lines 4 to 17 in aacbc22

	export const setupUser = async () => {
	await exec("git", [
	"config",
	"--global",
	"user.name",
	`"github-actions[bot]"`,
	]);
	await exec("git", [
	"config",
	"--global",
	"user.email",
	`"github-actions[bot]@users.noreply.github.com"`,
	]);
	};

[Andarist]

@jonrohan are you saying that using PAT is not enough and GitHub doesn't trigger workflows based on the user as well?

[jonrohan]

PAT tokens work on triggering actions, but this library is still using the GitHub action token when pushing commits

[Andarist]

@jonrohan not sure if I understand the issue you are facing. To the best of my knowledge, this is not possible - if you only give the PAT to us. We can't access the secrets on our own so the only way for us to access any token is for users to give it to us. Which is done using the GITHUB_TOKEN input. So it's entirely not to us what token we'll try to use - it's up to the user.

[itsdouges]

Hi I seem to have ran into this - subsequent "force pushes" to the version PRs aren't having CI run - the branches are "force pushed" by github-actions-bot, not the user account.

Strangely - keystone js doesn't seem to have this problem? What's different?

Mine: atlassian-labs/compiled#698

Keystones: keystonejs/keystone#5086

[emmatown]

It'll be because of this line: https://github.com/keystonejs/keystone/blob/955787055a54fb33eb45c80dd39fa86a9ff632a0/.github/workflows/release.yml#L17

[itsdouges]

Interesting! Will change it and see what happens. Edit: That works! atlassian-labs/compiled#698 Thanks @mitchellhamilton +++

[denieler]

yep, indeed, guys, it works for us too 👍 maybe we should include this recommendation in the docs?

[moonmeister]

Good context: https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#workarounds-to-trigger-further-workflow-runs