Tests are not executed if commit is made by another github action

Code to Cloud GitHub Actions
#1

Hi, I have a test workflow on a specific branch, which I use to open PR. It’s not a protected branch. Another action is triggered manually - modifies and commits file into same branch.

Commit appears in PR but the workflow is not executed. I have disabled vigilant mode. This is for a private enterprise repo.

The only solution I see is to bundle my private pgp key into github action secrets to sign the commit, but I think it’s more dangerous as opposed to running workflow on un-signed commit.

Is there a way to enable this? I couldn’t find after searching.

#2

How does that workflow authorize the push? In particular, to quote the docs:

When you use the repository’s GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run.

#3

I’ve tried it with a personal access token to run git push and also tried GitHub - ad-m/github-push-action: GitHub actions to push back to repository eg. updated code with personal access token - however in both cases ci/cd is still not executed on the push into branch.

#4

How are you providing the PAT to Git?

#5

Yes, that’s it exactly. Should I use PAT or there is a way to enable execution through permission yaml key in a workflow file?

#6

Yes, using a PAT is what you need to do to enable this. But you said you’ve tried it with a PAT and it didn’t work, so I wonder how you tried it (a workflow link is best). I’ve seen people who put their PAT into the workflow but the way it was set up the GITHUB_TOKEN got used anyway. :wink:

#7 
      - run: |
           git config user.name "......."
           git config user.email "...."
           git fetch --unshallow
           git switch pre-prod
           git commit --allow-empty -m 'test-empty-commit'
           # git push origin pre-prod
      - name: Push changes into pre-prod branch
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.PERSONAL_GITHUB_TOKEN }}
          branch: pre-prod

In the screenshot below wip commit was done using my local laptop with SSH key. The other commits (test-empty-commit) were done by a workflow.

The problem is that there is no execution indicator (red cross) next to test-empty-commits.

Screenshot 2022-04-27 at 10.35.30
Screenshot 2022-04-27 at 10.35.301179×313 35.8 KB

#8

That behavior indicates that you PAT isn’t used for the push.

The most important part is missing in your workflow excerpt: The actions/checkout step (assuming you don’t retrieve the repository in some custom way). By default it sets the repository up to always send an Authorization header with the GITHUB_TOKEN. You need to either pass your PAT at that point (token option), or disable persisting it (persist-credentials: false).

#9 
  - uses: actions/checkout@v2
    with:
      token: ${{ secrets.PERSONAL_GITHUB_TOKEN }}

Specifying token during the checkout step rather than the push worked perfectly. I can see now the documentation at GitHub - actions/checkout: Action for checking out a repo

The auth token is persisted in the local git config. This enables your scripts to run authenticated git commands. The token is removed during post-job cleanup. Set persist-credentials: false to opt-out.

Thanks for your help @airtower-luna , my issue is now resolved.

1 Like