Skip CD release workflow for bot commits#722
Conversation
The push-protected action relies on CI running on the push-action/** temp branch to satisfy required status checks before pushing to master. GitHub no longer triggers workflows for pushes made from within a running workflow, so the temp branch CI never runs, push-protected declares all checks vacuously complete, and the push fails. Instead, a repository ruleset now enforces required status checks on master with TEAM4-0 as an explicit bypass actor. The CD workflow pushes directly as TEAM4-0 using the RELEASE_PAT, bypassing the status check requirement for this automated bot commit.
Copilot review: actions/checkout persists GITHUB_TOKEN credentials that would override a remote URL change. Passing token: RELEASE_PAT to the checkout step ensures the persisted credential is already the RELEASE_PAT, so the git push uses it without needing to modify the remote URL.
push-protected is no longer used so these temp branches are never created. The trigger and its explanatory comment are dead code.
The bot commit triggers a new CD run, and invoke setver finds another version bump each time, creating an infinite loop. Guard against this by skipping the job when the triggering commit message starts with '[bot]'.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #722 +/- ##
=======================================
Coverage 84.34% 84.34%
=======================================
Files 26 26
Lines 805 805
=======================================
Hits 679 679
Misses 126 126 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
Closing in favour of reverting to the original git commit --amend approach, which prevents a second commit from being created and thus avoids the loop entirely. |
There was a problem hiding this comment.
Pull request overview
Prevents an infinite CD loop caused by the workflow’s own version-bump bot commit retriggering the release pipeline on master.
Changes:
- Skip the
update_versionjob incd_release.ymlwhen the triggering push commit message starts with[bot]. - Switch the version-bump push step from
CasperWA/push-protectedto a directgit pushand configureactions/checkoutto useRELEASE_PAT. - Remove the
push-action/**branch trigger from the CI tests workflow.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/ci_tests.yml |
Removes push-action/** from push triggers, limiting CI test runs on push to master only. |
.github/workflows/cd_release.yml |
Adds bot-commit guard to update_version and changes how version bump commits are pushed back to master. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| pre_sleep: 15 | ||
| force: false | ||
| unprotect_reviews: true | ||
| run: git push origin ${{ env.DEFAULT_REPO_BRANCH }} |
There was a problem hiding this comment.
Replacing CasperWA/push-protected@v2 with a plain git push will fail if master is protected (the workflow previously used push-protected with unprotect_reviews: true, which strongly suggests branch protection is in place). Either keep using push-protected, or confirm/update the branch protection rules to allow this workflow’s actor/token (RELEASE_PAT / GitHub Actions) to push directly to master (e.g., allow bypass or allow the PAT user to push).
| run: git push origin ${{ env.DEFAULT_REPO_BRANCH }} | |
| uses: CasperWA/push-protected@v2 | |
| with: | |
| token: ${{ secrets.RELEASE_PAT }} | |
| branch: ${{ env.DEFAULT_REPO_BRANCH }} | |
| unprotect_reviews: true |
| push: | ||
| branches: | ||
| - 'master' | ||
| - 'push-action/**' # Allow pushing to protected branches (using CasperWA/push-protected) | ||
|
|
There was a problem hiding this comment.
This PR removes the push-action/** branch trigger from the CI tests workflow, but the PR description only mentions the CD infinite-loop fix. If any automation still pushes temporary branches matching push-action/** (e.g., protected-branch push helpers), CI coverage for those pushes will stop. Either document this change in the PR description or keep the trigger if those branches are still used anywhere.
Summary
&& !startsWith(github.event.head_commit.message, '[bot]')to theupdate_versionjob condition so the CD workflow exits immediately when triggered by the bot's own version-bump commit.Why
The bot commit
[bot] Update version and CHANGELOGis a push to master, which triggers a new CD run.invoke setverfinds another version bump in that run, produces a second bot commit, which triggers a third run, and so on infinitely. The fix is to short-circuit the workflow at the job level before any work is done.Test plan
Click to view squash commit message