Repository navigation
fix(ci): use PAT in release.yml so release.published fires downstream - #148
Merged
Merged
Conversation
The default GITHUB_TOKEN is anti-recursion-gated, so the release.published event it emits never spawned update-package-channels.yml — leaving every v0.x.0 tap bump to a manual `gh workflow run` (escape hatch from 1edd01d). Substitute GH_TOKEN on the publish step only with a fine-grained RELEASE_PUBLISH_TOKEN PAT scoped to this repo (Contents: write). Build matrix is intentionally untouched — least privilege. Closes #130
6 tasks
laradji
pushed a commit
that referenced
this pull request
May 7, 2026
…dispatch The default GITHUB_TOKEN is allowed to call workflow_dispatch, but the resulting run's completion does not spawn workflow_run downstreams (anti-recursion gate). scrape-pack ran fine on the v0.7.2 tag push but chain-image never fired; a manual probe with a real user PAT did fire chain-image. Same failure mode #148 fixed for release.yml -> update-package-channels.yml. - Rewrite header comment to describe the gate accurately. - Add Validate secrets step mirroring release.yml's PAT check. - Switch GH_TOKEN on the dispatch step to CHAIN_DISPATCH_TOKEN. Closes #216.
3 of 6 tasks
laradji
added a commit
that referenced
this pull request
May 7, 2026
…dispatch (#217) The default GITHUB_TOKEN is allowed to call workflow_dispatch, but the resulting run's completion does not spawn workflow_run downstreams (anti-recursion gate). scrape-pack ran fine on the v0.7.2 tag push but chain-image never fired; a manual probe with a real user PAT did fire chain-image. Same failure mode #148 fixed for release.yml -> update-package-channels.yml. - Rewrite header comment to describe the gate accurately. - Add Validate secrets step mirroring release.yml's PAT check. - Switch GH_TOKEN on the dispatch step to CHAIN_DISPATCH_TOKEN. Closes #216. Co-authored-by: Nacer Laradji <nacer.laradji@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GH_TOKENonrelease.yml'sCreate GitHub releasestep from the defaultGITHUB_TOKENto a fine-grained PAT (RELEASE_PUBLISH_TOKEN, scopelaradji/deadzoneonly,Contents: Read and write).release.published→update-package-channels.ymlchain that GitHub's anti-recursion rule blocks when the publish event is emitted by the default token.Why
GitHub's documented behaviour: events triggered by the default
GITHUB_TOKENdo not spawn new workflow runs. v0.2.0 (2026-04-17) confirmed this in production — the tap bump never auto-fired and had to be triggered manually via theworkflow_dispatchescape hatch added in1edd01d. That escape hatch stays as the manual fallback (out of scope for this change, per #130).Operator action required before this is effective
RELEASE_PUBLISH_TOKEN(scope: this repo only,Contents: Read and write, no other permissions).v0.0.0-token-probe→ confirmupdate-package-channels.ymlfires automatically → cleanup release + tag.Test plan
grep -c 'GH_TOKEN' .github/workflows/release.yml→ still 1 active site (the publish step), no other substitutionsbuildjob) still uses no token override — only the finalCreate GitHub releasestep takes the PATv0.0.0-token-probeafter merge, per fix(ci): use PAT in release.yml so release.published fires downstream workflows #130 acceptance criteriaCloses #130