Not working on a protected branch

[brianjmurrell]

Version of the Action
v4.4.0

Describe the bug
Not working with a protected branch despite the project enabling force-pushes.

Screenshots

Used Workflow
https://github.com/daos-stack/pipeline-lib/blob/master/.github/workflows/update_pipeline_lib_branch.yml

The failed action: https://github.com/daos-stack/pipeline-lib/runs/900246701?check_suite_focus=true

I was able to push from the CLI:

$ git push origin HEAD:master
Enumerating objects: 5, done.
Counting objects: 100% (5/5), done.
Delta compression using up to 8 threads
Compressing objects: 100% (3/3), done.
Writing objects: 100% (3/3), 380 bytes | 380.00 KiB/s, done.
Total 3 (delta 2), reused 0 (delta 0)
remote: Resolving deltas: 100% (2/2), completed with 2 local objects.
To github.com:daos-stack/pipeline-lib.git
   a1bf9ea..fb2658d  HEAD -> master

[stefanzweifel]

Another user recently mentioned this problem in an already closed issue (#71 (comment)).

I didn't have the time yet to test it myself, but could you try creating a Personal Access Token (PAT) and use that token instead of the normal secrets.GITHUB_TOKEN?

https://github.com/stefanzweifel/git-auto-commit-action#commits-of-this-action-do-not-trigger-new-workflow-runs

Will update the README accordingly when we've found the solution that works for everybody.

[localheinz]

@brianjmurrell @stefanzweifel

Works fine with a personal access token!

👌

[stefanzweifel]

@localheinz Thanks for the update! Will rewrite the section about protected branches in the README soon.

[brianjmurrell]

How does a Personal Access Token work for teams/organisations where dozens of people work on the same repo?

[stefanzweifel]

@brianjmurrell I guess your question is: "How can I create a Personal Access Token for an org?"

That's currently not possible. I think this SO answer sums it up pretty good:

That's not possible currently, you can only create tokens for user accounts since user accounts have permissions associated with them (organizations don't). So, you'd need to create a token with an account which has access to the repository in question and give that to Travis. You can also create a machine account for that purpose.

https://stackoverflow.com/a/31160721/3863449

If you're in an org and don't want to create a PAT from your own personal accounts, the recommended way is to create a machine/bot account, and create a PAT from that machine account.

[localheinz]

@brianjmurrell

As @stefanzweifel said: I have created @ergebnis-bot and use its personal access token in repositories I control.

Similarly, in other organizations we have also created bot accounts. Secrets can be easily shared using organization secrets.

[stefanzweifel]

Just a quick update: I've updated the README with a note on protected branches. In addition to the --force-option which has to be passed to the Action, I've also added a note on the need of a PAT.

https://github.com/stefanzweifel/git-auto-commit-action#push-to-protected-branches

I'm closing this issue for now. If you think your issue is not resolved or have any other question, feel free to reopen or create a new issue.

[brianjmurrell]

It seems like opening quite a wide gate to allow force pushes to protected branches. We have that disabled specifically to prevent accidental pushes to master where a user meant to push to their own PR/branch. Is there no finer grained control over this than all-or-none?

[stefanzweifel]

@brianjmurrell It's definitely not the most beautiful solution for this problem, however, this Action just uses the git-binary to do all the action.
As far as I know, there are no API endpoints which would accomplish the same which would make this whole "push to protected branch"-thing safer.

And I totally understand that your org has enabled protected branches and disabled the force-push option. (The feature exists for that reason 😄 )

However, if Actions would be excluded from these rules and Actions could push to protected branches, they could create the same havoc as a user would be able to 🤷

[dimitarspassov]

I have an issue, which I feel belongs to this discussion.

There is a "Commits of this Action do not trigger new Workflow runs" in the README, which states: The resulting commit will not trigger another GitHub Actions Workflow run.. And according to the GitHub limitations, using a personal access token (PAT) changes this behaviour.

My goal is to create a workflow in an organization repository, which has a step that commits and pushes changes through this action. The branch is protected so I have do force push and to use a bot with PAT. But using PAT causes recursive workflow runs. Is there a way to fix this?

I guess my workflow could need rethinking, but if this is a common scenario (as it seems to me), then using this action with PAT will always cause recursive workflow runs.

[stefanzweifel]

@dimitarspassov Using this Action with a PAT shouldn't cause recursive workflows runs automatically. It all depends on what your workflow is changing.

For example, if your workflow is storing the current time and date in a text file (date > current-date.txt), and you commit and push the file to the remote repository with a PAT, it will definitely cause endless recursive workflow runs.

If your workflow does something similar and everytime it runs would commit something, I think you should be able to prevent the endless workflows runs by using if conditions on the job. (Docs about if conditions)

The above example could look like this:
The workflow clones the repo, writes the current time in a txt-file and commits the changes pack to the repo by using a PAT. Howerver, the job itself is protected by a if-clause and will only run, if the user who started the workflow run is not org-bot.

name: My Workflow

on: push

jobs:
  my-workflow:

    # ↓ This condition is important
    if: github.actor != 'org-bot' 

    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
      with:
        token: ${{ secrets.PAT }}
        ref: ${{ github.head_ref }}

    # ...

    run: date > current-date.txt

    - uses: stefanzweifel/git-auto-commit-action@v4
      with:
        commit_message: My Commit Message
        branch: ${{ github.head_ref }}
        commit_user_name: org-bot

But please note: I'm not 100% sure this actually works. I'm not sure if commit_user_name and github.actor are the same values or if you would have to use the actual GitHub username of your bot account here.

[dimitarspassov]

Thank you @stefanzweifel for the quick answer.

I've just finished testing and it seems that the if-conditions are the way to go here.

Unfortunately, I have a workflow job, that is required as part of the branch protection. Even with force pushes allowed and using the bot's PAT, I get an error:

remote: error: GH006: Protected branch update failed for refs/heads/master.        
remote: error: Required status check "build-and-test" is expected.   

I suppose what I'm trying to achieve may not be possible, but is there still a way to work this out?