Skip to content

Commit 0a52f4b

Browse files
committed
Use release events to trigger builds from automated weekly releases
GitHub Actions tokens cannot trigger workflows on tag creation (security feature). This change replaces git tag + push with gh release create, which triggers release events that CAN activate workflows. Changes: - scheduled-releases.yml: Use gh release create instead of git tag + push - build.yml: Add release: types: [published] trigger with weekly-only filter The filter ensures only automated weekly releases trigger builds, blocking manual releases until needed Ref: https://github.com/orgs/community/discussions/76402
1 parent 4d386f0 commit 0a52f4b

2 files changed

Lines changed: 33 additions & 10 deletions

File tree

.github/workflows/build.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,12 @@ on:
1313
pull_request:
1414
branches: [ main ]
1515

16+
# Triggers on release publication (including automated weekly releases)
17+
# Note: Tag events don't trigger from GitHub Actions, but release events do
18+
# This allows scheduled-releases.yml to trigger builds via gh release create
19+
release:
20+
types: [published]
21+
1622
# Allows you to run this workflow manually from the Actions tab
1723
workflow_dispatch:
1824
merge_group:
@@ -80,6 +86,22 @@ jobs:
8086

8187
# Steps represent a sequence of tasks that will be executed as part of the job
8288
steps:
89+
# Filter release events to only process weekly releases
90+
# Note: Release events don't support pattern filtering, so we filter manually
91+
# This allows both manual releases and automated weekly releases to trigger builds
92+
- name: Filter release events
93+
if: github.event_name == 'release'
94+
id: filter-release
95+
run: |
96+
$tagName = "${{ github.event.release.tag_name }}"
97+
if ($tagName -match "^release/weekly/") {
98+
Write-Host "Matched weekly release tag: $tagName"
99+
exit 0
100+
} else {
101+
Write-Host "Tag does not match weekly pattern: $tagName - skipping build"
102+
exit 1
103+
}
104+
83105
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
84106
- name: Checkout Repository
85107
uses: actions/checkout@v4

.github/workflows/scheduled-releases.yml

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,17 @@ jobs:
2222
token: ${{ secrets.GITHUB_TOKEN }}
2323
fetch-depth: 0 # Fetch all history for merging
2424

25-
- name: Configure Git
26-
run: |
27-
git config user.name 'github-actions[bot]'
28-
git config user.email 'github-actions[bot]@users.noreply.github.com'
29-
30-
- name: Create tag
31-
id: create-tag
25+
- name: Create release
26+
id: create-release
3227
run: |
3328
# Date in the format YYMMDD
3429
TAG="release/weekly/$(date +%y%m%d)"
35-
git tag -a "$TAG" -m "Release $TAG"
36-
git push origin "$TAG"
37-
30+
# gh release create will automatically create the tag if it doesn't exist
31+
# This triggers the build workflow's tag listener, unlike git tag + git push
32+
# which doesn't trigger workflows when done by Actions tokens
33+
gh release create "$TAG" \
34+
--title "Weekly Release $(date +%y%m%d)" \
35+
--generate-notes \
36+
--prerelease
37+
env:
38+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)