Push by workflow does not trigger another workflow anymore

[RyanMeulenkamp]

Hi,

On one of our project we have had a bot user that updates a dependency for us using action update_dependency.yml (triggered by workflow dispatch from another repo). On that same project we have a workflow that triggers on any push, build.yml. Previously, the bot user updating a dependency, and pushing this commit, would trigger build.yml, but it suddenly stopped doing that.

The documentation states that one workflow can trigger another workflow only if it's not using secrets.GITHUB_TOKEN. We are not using that token. Why has build.yml suddenly stopped triggering? Has there recently been a policy change for tokens? When any of the developers push something it will still trigger fine, but not from another workflow.

Thanks,

Ryan

[ossanna16]

Hi there @RyanMeulenkamp and welcome to our community! Thank you for asking a great question 🙂

[RyanMeulenkamp]

And thank you for the warm welcome 😃

[spenserblack]

I believe that, by default, git in a workflow is authenticated with that same token. You should be able to bypass this restriction by setting up your own personal access token instead of using the builtin secrets.GITHUB_TOKEN/github.token.
Further reading: https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow

[RyanMeulenkamp]

Thanks for your response! But like I said, I've read the documentation, I'm not using secrets.GITHUB_TOKEN, and our workflow used to work as expected. We have a dedicated PAT in the secrets, secrets.CI_PAT. We have set up a composite action that does the actual code change, commit and push using git CLI commands.
If I change secrets.CI_PAT to one created by a different user I can also confirm on Github that the commit was done by that person. But still, it doesn't trigger the build.yml workflow. Here's a simplified version of that action:

name: Update dependency

inputs:
  branch:
    description: 'The branch name to apply the change to'
    required: true

  revision:
    description: 'The new source revision'
    required: true

  pat:
    description: 'Personal Access Token required to execute API calls'
    required: true

runs:
  using: "composite"
  steps:
    - name: Checkout given branch
      uses: actions/checkout@v3
      with:
        fetch-depth: 0
        ref: ${{ inputs.branch }}

    - name: Update dependency
      run: sed -ri 's/(REVISION = ).*/\1"${{ inputs.revision }}"/g' ./some_file
      shell: bash

    - name: Get personal access token username
      id: get_pat_username
      run: echo "ci_pat_user=$(curl -s https://${{ inputs.pat }}:@api.github.com/user | jq -r .name)" >> $GITHUB_OUTPUT
      shell: bash

    - name: Commit changes
      run: |
        git config user.name "${{ steps.get_pat_username.outputs.ci_pat_user }}" && \
        git add . && \
        git commit -m "[github actions] Update dependency"
      shell: bash

    - name: Push changes
      run: git push https://${{ inputs.pat }}@github.com/nedap/retail-sonor-os.git
      shell: bash

Might it be that the policy changed on pushes using basic HTTP auth with a PAT?

[airtower-luna]

actions/checkout sets up the repository so it'll always send the GITHUB_TOKEN in an Authorization header, unless you tell it otherwise. What you add to the URL doesn't matter with that, I'm surprised it worked at some point. 😅

You need to either provide the token you want to use to actions/checkout as its token parameter (the easy way), or disable persist-credentials (then you still have to explicitly provide the token later). See the usage description.

[RyanMeulenkamp]

This seems to have made the difference. Thanks! Interesting that it used to work, indeed.

[jeromecovington]

I can confirm that overriding the implicit GITHUB_TOKEN used by actions/checkout with an explicit token: PAT allowed subsequent workflows to be triggered by push events.

[dangthanhvinh003]

Good Project