unable to push git tag on protected branch with required status checks

[Clumsy-Coder]

I'm unable to have semantic-release push a new tag and commit on a protected branch with require status checks.

things done so far

• use custom Personal access token with public_repo permission
• use custom Personal access token with full repo permissions
• Add permission to a github-action job

---

configs

.releaserc.js

module.exports = {
  branches: ['master', { name: 'development', prerelease: true }],
  tagFormat: '${version}',
  plugins: [
    '@semantic-release/commit-analyzer',
    '@semantic-release/release-notes-generator',
    '@semantic-release/changelog',
    '@semantic-release/github',
    ['@semantic-release/npm', { npmPublish: false }],
    [
      '@semantic-release/git',
      {
        assets: ['CHANGELOG.md', 'package.json', 'package-lock.json'],
      },
    ],
    'semantic-release-export-data',
  ],
  // use https://github.com/conventional-changelog/conventional-changelog/tree/master/packages/conventional-changelog-conventionalcommits
  // release rules: https://github.com/semantic-release/commit-analyzer/blob/master/lib/default-release-rules.js
  preset: 'conventionalcommits',

  // git emoji obtained from
  //    https://gist.github.com/parmentf/035de27d6ed1dce0b36a
  //    https://github.com/caiyongji/emoji-list
  //    https://github.com/pvdlg/conventional-changelog-metahub#commit-types
  // preset config for generating release notes and changelogs
  //    https://github.com/conventional-changelog/conventional-changelog-config-spec/blob/master/versions/2.0.0/README.md#type
  // prettier-ignore
  presetConfig: {
    types: [
      { type: "feat",     section: ":sparkles: Features",                             hidden: false }, // MINOR
      { type: "fix",      section: ":bug: Bug Fixes",                                 hidden: false }, // PATCH
      { type: "perf",     section: ":zap: Performance Improvements",                  hidden: false }, // PATCH
      { type: "revert",   section: ":rewind: Reverts",                                hidden: true  }, // NO_RELEASE
      { type: "docs",     section: ":books: Documentation",                           hidden: true  }, // NO_RELEASE
      { type: "style",    section: ":lipstick: Styles",                               hidden: true  }, // NO_RELEASE
      { type: "chore",    section: ":octopus: Miscellaneous Chores",                  hidden: true  }, // NO_RELEASE
      { type: "refactor", section: ":recycle: Code Refactoring",                      hidden: true  }, // NO_RELEASE
      { type: "test",     section: ":white_check_mark: Tests",                        hidden: true  }, // NO_RELEASE
      { type: "build",    section: ":package: Build System",                          hidden: true  }, // NO_RELEASE
      { type: "ci",       section: ":construction_worker: Continuous Integration",    hidden: true  }, // NO_RELEASE
    ],
  },
};

.github/workflows/build.yaml

  install:      # install npm packages and store node_modules to cache
  lint:         # lint code
  docker-build: # build docker image, if on master or development branch, push to github
  
  semantic-release:
    needs: docker-build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/development'
    steps:
      - uses: actions/checkout@v2

      - uses: actions/cache@v3
        id: npm-cache # use this to check for `cache-hit` ==> if: steps.npm-cache.outputs.cache-hit != 'true'
        with:
          path: |
            **/node_modules
            ${{ needs.install.outputs.npm-cache-dir }}
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - run: npm install --production=false

      - name: semantic-release
        run: npx semantic-release --ci
        env:
          GITHUB_TOKEN: ${{ secrets.DEPENDABOT_TOKEN }}

protected branch settings

error returned

[travi]

from the error output, you can see that @semantic-release/git is failing. this means that the commit containing the changes to CHANGELOG.md, package.json, package-lock.json is failing to be pushed, not the tag (the tag is handled by core).

Do you really need to commit the changes to these files? semantic-release does not need them in order to work over time and making a commit with those changes greatly complicates the overall process, like how it is failing to push because of your branch protection settings. the simplest solution to your problem would be to remove the git plugin.

if you decide that you dont want to remove that, you need to use a token for a user that has the ability to push commits to your branch based on your protection rules. semantic-release cannot bypass the protection rules that you have configured, so you would need to work within those restrictions.

[Clumsy-Coder]

How do I create a token to be able to push a commit and a new semantic-release tag on a protected branch?

[travi]

you need to create a personal access token for a user that has permission to push to the protected branch. the ability for semantic-release to push entirely depends on the permissions available to the token passed to it. it can be helpful to have a dedicated user for automated tasks, like releases, so that these permissions are specific to that user rather than a specific team member.

[Clumsy-Coder]

Found the solution.

1. Use personal access token of public_repo (for public repos) or repo (for private and public repos) permission

2. Make sure to NOT persist credentials when pulling the git repo in github-actions

  semantic-release:
    needs: docker-build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/development'
    steps:
      - uses: actions/checkout@v3
        with:
          persist-credentials: false

      - uses: actions/cache@v3
        id: npm-cache # use this to check for `cache-hit` ==> if: steps.npm-cache.outputs.cache-hit != 'true'
        with:
          path: |
            **/node_modules
            ${{ needs.install.outputs.npm-cache-dir }}
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - run: npm install --production=false

      - name: semantic-release
        run: npx semantic-release --ci
        env:
          GITHUB_TOKEN: ${{ secrets.DEPENDABOT_TOKEN }}

---

The issue wasn't that the Personal access token wasn't working, it was that it was not being used.
setting persist-credential: false will instruct github-actions to use the personal access token.

[Clumsy-Coder]

also check

https://github.com/semantic-release/semantic-release/blob/8fda7fd423d24e7b425fbee83790f49dd0478e2d/docs/recipes/ci-configurations/github-actions.md#pushing-packagejson-changes-to-a-master-branch

[niyowski]

@Clumsy-Coder, persist-credential: false was exactly my problem. Thanks for this discussion; it truly made my day.

[cloverink]

Thank you bro