Workflow for tags is not triggered after performing git push --follow-tags with PAT in Actions environment

[frantic1048]

Select Topic Area

Bug

Body

Description

We have a repository with a GitHub action that conditionally create a new commit(and annotated git tag(s)) and push it back to the repository with a Personal Access Token, done through beachball's publish command.

git config --local user.email "npm-publisher@rightcapital.com"
git config --local user.name "GitHub Actions[bot]"
git remote set-url origin "https://${{ secrets.REPO_AUTOMATION_TOKEN }}@github.com/${{ github.repository }}.git"
pnpm beachball publish --yes -m 'chore(release): applying package updates'

reference: https://github.com/RightCapitalHQ/frontend-style-guide/blob/8052e3de61efb8c2b1aea424ce14c30b1ad89f50/.github/workflows/ci.yml#L98-L101

About beachball publish, it does a git tag <args>(tagPackages.ts) and followed by a git push --follow-tags(bumpAndPush.ts).

After pushing the new commit and tags(always start with @rightcapital/), it successfully triggers workflow for the branch(on.push.branches: ['main']), but never triggers workflow for tags(on.push.tags: ['@rightcapital/**']) (We're using this workflow to create Releases on GitHub). Here's the workflow definition:

• runs on branch push: https://github.com/RightCapitalHQ/frontend-style-guide/blob/8052e3de61efb8c2b1aea424ce14c30b1ad89f50/.github/workflows/ci.yml
• runs on tag push: https://github.com/RightCapitalHQ/frontend-style-guide/blob/8052e3de61efb8c2b1aea424ce14c30b1ad89f50/.github/workflows/release.yml

Example commit(with tags on it) that only triggers workflow for branch, but does not trigger workflow for tag: RightCapitalHQ/frontend-style-guide@8052e3d

I think both workflows(includes the workflow runs on tag push) should run when push new commit with tags.

---

Other info:

Here's a minimal repo with similar automation process as above repo(https://github.com/RightCapitalHQ/frontend-style-guide). Unfortunately I cannot reproduce the same symptom in this minimal repo.

https://github.com/frantic1048/workflow-for-automated-tags

Reproduction Steps

Each time the commit chore(release): applying package updates with tags are pushed to the repo(RightCapitalHQ/frontend-style-guide), for example:

• RightCapitalHQ/frontend-style-guide@8052e3d
• RightCapitalHQ/frontend-style-guide@171d0a8 (Note: there is a workflow for tag being created on this commit, it is triggered by a human manually pushing a tag from a computer, not by GitHub workflow)

[I-Want-ToBelieve]

Confirmed that the issue is reproduced: Neither GITHUB_TOKEN nor PAT can trigger tags listening for other actions

[I-Want-ToBelieve]

https://github.com/orgs/community/discussions/27194#discussioncomment-7038913

[sysserv]

You can modify your workflow to trigger on both commit and tag push events. this will ensure that the workflow runs whenever a new commit or tag is pushed to the repository.

name: Release

on:
  push:
    branches: [ main ]
  tags:
    tags: [ '@rightcapital/**' ]

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Create release
        uses: actions/create-release@v6
        with:
          tag_name: ${{ github.event_name }}
          release_name: ${{ github.event_name }}
          draft: false
          prerelease: false

      - name: Upload release assets
        uses: actions/upload-artifact@v3
        with:
          name: release-assets
          path: ./dist/*.zip

the workflow will run whenever a new commit or tag is pushed to the repository. for commits, it will trigger on the main branch, while for tags, it will trigger on any tag that starts with @rightcapital/

[I-Want-ToBelieve]

i will try this

[I-Want-ToBelieve]

I thought about it, I can't do this, github release is released by other actions,

I need to listen to the events created by github release or tags and then publish it elsewhere.

If I listen to the creation of github release, my action can It is triggered by other actions, but the github release event does not support filtering. I have to use a shell script to filter it myself.

The github tags event supports filtering, but it will not be triggered by other github actions.

Now I use manual triggering

       git push origin --delete some@tags
       git push origin  some@tags

[sysserv]

Use a shell script to filter the release event

You can use a shell script to filter the release event and only run your workflow when the tag name matches a specific pattern. Here's an example:

on:
  release:
    types: [published]

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Filter release event
        id: filter-release
        run: |
          tag_name="${{ github.event.release.tag_name }}"
          if [[ "$tag_name" =~ ^@rightcapital/.* ]]; then
            echo "Matched tag name: $tag_name"
            exit 0
          else
            echo "Tag name does not match: $tag_name"
            exit 1
          fi

      - name: Publish release
        uses: actions/create-release@v6
        if: steps.filter-release.outputs.status == 0

In this example, the filter-release step uses a shell script to check if the tag name starts with @rightcapital/.

If it does, it exits with a status code of 0, which means that the publish-release step will run. If the tag name doesn't match, it exits with a status code of 1, which means that the publish-release step will not run.