[Q]: "released" trigger is never fired when using recommended release drafter action

[stevenengland]

Hi,

maybe this is the wrong place but I thougth I might give it a try because in the readme of this action the release-drafter action is recommended:

I use the changelog updater action this way:

---
name: Changelog Updating

"on":
  release:
    types: [released]

jobs:
  update:
    name: Update Changelog
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.release.target_commitish }}

      - name: Update Changelog
        uses: stefanzweifel/changelog-updater-action@v1
        with:
          latest-version: ${{ github.event.release.tag_name }}
          release-notes: ${{ github.event.release.body }}

      - name: Commit updated CHANGELOG
        uses: stefanzweifel/git-auto-commit-action@v4
        with:
          branch: ${{ github.event.release.target_commitish }}
          commit_message: 'docs(changelog): update changelog'
          file_pattern: CHANGELOG.md

In another workflow I call the release drafter:

      - name: Publish the release notes
        uses: release-drafter/[email protected]
        with:
          publish: ${{ steps.check-version.outputs.tag != '' }}
          tag: ${{ steps.check-version.outputs.tag }}
          config-name: release_drafting_config.yml
          disable-autolabeler: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

As a result an actual release is published. But the changelog updater workflow does not get triggered. No fail, just not executed. I wonder if the release drafter action causes the correct events to be fired that would trigger on->release->types->"released". Or do I need to enable something else anywhere? Thanks in advance!

[stefanzweifel]

I think the problem is, that you're triggering the release[released] event through your release-drafter Action. The default GITHUB_TOKEN doesn't allow / blocks that.

From the GitHub docs:

When you use the repository's GITHUB_TOKEN to perform tasks on behalf of the GitHub Actions app, events triggered by the GITHUB_TOKEN will not create a new workflow run. This prevents you from accidentally creating recursive workflow runs.

To solve this, you must create a so called "personal access token" or "PAT". You then have to add the token as a secret to your repository or organisation and reference it in your workflow.

      - name: Publish the release notes
        uses: release-drafter/[email protected]
        with:
          publish: ${{ steps.check-version.outputs.tag != '' }}
          tag: ${{ steps.check-version.outputs.tag }}
          config-name: release_drafting_config.yml
          disable-autolabeler: true
        env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+         GITHUB_TOKEN: ${{ secrets.PAT }}

Using the PAT, the restrictions are lifted and the release[released] event should be fired and trigger the "Update Changelog" workflow as expected.

[stevenengland]

I think the problem is, that you're triggering the release[released] event through your release-drafter Action. The default GITHUB_TOKEN doesn't allow / blocks that.

From the GitHub docs:

When you use the repository's GITHUB_TOKEN to perform tasks on behalf of the GitHub Actions app, events triggered by the GITHUB_TOKEN will not create a new workflow run. This prevents you from accidentally creating recursive workflow runs.

To solve this, you must create a so called "personal access token" or "PAT". You then have to add the token as a secret to your repository or organisation and reference it in your workflow.

      - name: Publish the release notes
        uses: release-drafter/[email protected]
        with:
          publish: ${{ steps.check-version.outputs.tag != '' }}
          tag: ${{ steps.check-version.outputs.tag }}
          config-name: release_drafting_config.yml
          disable-autolabeler: true
        env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+         GITHUB_TOKEN: ${{ secrets.PAT }}

Using the PAT, the restrictions are lifted and the release[released] event should be fired and trigger the "Update Changelog" workflow as expected.

I am still weighing up the alternatives, PAT vs. direct workflow call. One more question that arose while having a look at the PAT solution:

As the Github docs are not very clear about that: The PAT (fine grained one) will need the permissions that where needed for the original job and additionally... maybe actions: write for workflows, workflow runs and artifacts? Or even deployments: write. I will try it out soon.

[stefanzweifel]

As the default GITHUB_TOKEN requires the contents: write permissions, I assume your PAT does so too to push the updated CHANGELOG.md file to the repository.

Don't know what else you would require. actions: write I think is used if your GitHub Actions workflow would update a GitHub Actions workflow file (eg. .github/workflows/new-workflow.yml).

deployments: write should be related to environments/deployments. Atleast changelog-updater-action does not interact with that API.

[stevenengland]

Thats a good point! Thank you!

Would you mind to add a hint into the docs where you recommended release drafter?

Do you think that using the changelog workflow triggered after the release action via workflow import should overcome this issue? I will read the docs... But maybe you already know the answer...

# Changelog workflow
"on":
  workflow_call:
...

# Release workflow
...
      - name: Publish the release notes
        uses: release-drafter/[email protected]
        with:
          publish: ${{ steps.check-version.outputs.tag != '' }}
          tag: ${{ steps.check-version.outputs.tag }}
          config-name: release_drafting_config.yml
          disable-autolabeler: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

     changelog_updating:
       - if: ${{ steps.check-version.outputs.tag != '' }}
         uses: ./.github/workflows/changelog_updating.yml

[stefanzweifel]

I've added a note in bdcfdf7 to the README.

Do you think that using the changelog workflow triggered after the release action via workflow import should overcome this issue? I will read the docs... But maybe you already know the answer...

That could maybe work, but you would then have to extract latest-version and release-notes from the release-drafter-step in your "release"-workflow.
The Action supports outputs, so that should be doable.

The "update-changelog" workflow of yours currently reads the following important values from the release-event

latest-version: ${{ github.event.release.tag_name }}
release-notes: ${{ github.event.release.body }}

Something like this can probably technically work. As I don't see the entire workflow, I can only provide parts.
And I also haven't tested this. :)

# Release Workflow
      - name: Publish the release notes
        id: publish_release_notes
        uses: release-drafter/[email protected]
        with:
          publish: ${{ steps.check-version.outputs.tag != '' }}
          tag: ${{ steps.check-version.outputs.tag }}
          config-name: release_drafting_config.yml
          disable-autolabeler: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


     changelog_updating:
       - if: ${{ steps.check-version.outputs.tag != '' }}
         uses: ./.github/workflows/changelog_updating.yml
         with:
          # Pass tag_name and release body to other workflow
          latest_version: ${{ steps.publish_release_notes.outputs.tag_name }}
          release_notes: ${{ steps.publish_release_notes.outputs.body }}

# Changelog Workflow
name: Changelog

on:
  workflow_call:
    inputs:
      latest_version:
        required: true
        type: string
      release_notes:
        required: true
        type: string

      # Other steps

      - name: Update Changelog
        uses: stefanzweifel/changelog-updater-action@v1
        with:
          latest-version: ${{ inputs.latest_version }}
          release-notes: ${{ inputs.release_notes }}