IBX-11778: Updated deprecated GitHub Actions in auto_tag and nightly workflows#285
Draft
alongosz wants to merge 4 commits into
Draft
IBX-11778: Updated deprecated GitHub Actions in auto_tag and nightly workflows#285alongosz wants to merge 4 commits into
alongosz wants to merge 4 commits into
Conversation
Aligned with the IBX-11778 treatment from ibexa/gh-workflows#103, adjusted for metapackages: - Bumped actions/create-github-app-token from v2 to v3 and switched the deprecated app-id input to client-id (nightly.yml was already on v3 but still passed app-id) - Replaced tibdex/github-app-token@v1 with actions/create-github-app-token@v3 in the action job - Replaced octokit/request-action with equivalent gh api calls: GET calls preserve the data output consumed by later steps; the nightly workflow-dispatch trigger now uses gh api --method POST, which also drops the !!str ref workaround - Bumped actions/checkout from v3 to v7 and all jobs to ubuntu-26.04 - Removed steps guarded by other editions' repository names (the file was designed to be copy-pasted between edition repositories, but the copies have since diverged, including a stale content condition dead since the rename to headless) and the unused cs2pr tool Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 21, 2026
The Commit, tag and push step used the EZROBOT_PAT personal access token and rewrote the origin remote URL to embed it, while the job already generates a GitHub App installation token. Now: - the push step receives the app token via its GITHUB_TOKEN env and authenticates git through gh auth setup-git (gh acting as the git credential helper), keeping the whole credential flow local to the step - checkout stays credential-free and no secret is written to .git/config - the release commit is authored as github-actions[bot] instead of ezrobot, which no longer plays any role here - inputs.version is passed to the shell via the step's VERSION env instead of raw workflow-expression interpolation Note before merging: this path only runs with real_op: true, so PR CI does not exercise it. The automation GitHub App must have contents write permission and any tag protection allowances previously granted to the ezrobot account. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The Create Tag workflow now keeps only its edition-specific data and delegates the mechanics to two composite actions in ibexa/gh-workflows: - check-composer-package (preparation) checks that the required package version is available on the Composer repository that composer update will actually consume — more accurate than the previous GitHub-tag probe, which could pass while the package was not yet installable; - create-metapackage-tag (action) fetches the release definition, derives minimum stability, pins the parent/assets packages, patches require versions, updates composer.lock and, with real_op, commits, tags and pushes using the GitHub App token. Behavior is unchanged apart from the more accurate preparation check and the dropped sponge/moreutils dependency. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Allows testing the new composite actions before the ibexa/gh-workflows pull request that introduces them is merged. Drop before merging. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Caution
Related PRs:
Description:
Upgraded or replaced the GitHub Actions in the
auto_tag.ymlandnightly.ymlworkflows that still run on the deprecated Node.js 20 runtime (to be removed from GitHub runners on September 16th, 2026):actions/create-github-app-tokenfrom v2 to v3 and switched the deprecatedapp-idinput toclient-id(nightly.ymlwas already on v3 but still passedapp-id);tibdex/github-app-token@v1withactions/create-github-app-token@v3in theactionjob;octokit/request-action@v2.xusages with equivalentgh apicalls: GET calls preserve thedataoutput consumed by later steps, and the nightly workflow-dispatch trigger now usesgh api --method POST, which also drops the!!strref workaround;actions/checkoutfrom v3 to v7 and all jobs to theubuntu-26.04runner;contentcondition dead since the rename toheadless) and the unusedcs2prtool.EZROBOT_PAT(ezrobot personal access token) in theCommit, tag and pushstep with the GitHub App token the job already generates: the step authenticates git throughgh auth setup-gitwith the token in its env — the credential flow stays local to the step and no secret is written into the remote URL /.git/config. The release commit is now authored asgithub-actions[bot], andinputs.versionis passed to the shell via the step env instead of raw workflow-expression interpolation.All other workflows in this repository only call
ibexa/gh-workflows/...@mainreusable workflows (deliberately trunk-tracking, already covered by ibexa/gh-workflows#103) and required no changes.Update: the workflow has since been refactored on this branch to use the shared composite actions from ibexa/gh-workflows#105 (
check-composer-package+create-metapackage-tag) — the file now keeps only edition-specific data. The preparation check now queries the Composer repository (Packagist/Satis) thatcomposer updateactually consumes, instead of probing for a GitHub tag. A[TMP]commit points the action references at the gh-workflows feature branch for testing; it must be dropped before merging.For QA:
No manual QA required. The Create Tag workflow can be validated by dispatching it with
real_op: false(dry run — no tag is pushed) once a suitablerelease.jsonexists in ibexa/release-maker. The nightly trigger can be validated by dispatching Nightly browser tests manually.Before merging: the
Commit, tag and pushpath only runs withreal_op: true, so PR CI does not exercise it — verify the automation GitHub App has contents write permission and any tag protection allowances previously granted to the ezrobot account.Documentation:
No documentation required.