IBX-11778: Updated deprecated GitHub Actions in auto_tag workflow - #286
Open
alongosz wants to merge 5 commits into
Open
IBX-11778: Updated deprecated GitHub Actions in auto_tag workflow#286alongosz wants to merge 5 commits into
alongosz wants to merge 5 commits into
Conversation
Aligned with the IBX-11778 treatment from ibexa/gh-workflows#103, adjusted for metapackages: - Bumped actions/create-github-app-token from v2 to v3, switching the deprecated app-id input to client-id - Replaced tibdex/github-app-token@v1 with actions/create-github-app-token@v3 in the action job - Replaced octokit/request-action with equivalent gh api calls, preserving the data output consumed by later steps - Bumped actions/checkout to v7 and both jobs to ubuntu-26.04 - Removed steps guarded by other editions' repository names (the file was designed to be copy-pasted between edition repositories, but the copies have since diverged) and the unused cs2pr tool. Headless deliberately does not wait for its parent package (ibexa/oss), which is available on Packagist, not via Satis; a comment now records that Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 21, 2026
The Commit, tag and push step used the EZROBOT_PAT personal access token and rewrote the origin remote URL to embed it, while the job already generates a GitHub App installation token. Now: - the push step receives the app token via its GITHUB_TOKEN env and authenticates git through gh auth setup-git (gh acting as the git credential helper), keeping the whole credential flow local to the step - checkout stays credential-free and no secret is written to .git/config - the release commit is authored as github-actions[bot] instead of ezrobot, which no longer plays any role here - inputs.version is passed to the shell via the step's VERSION env instead of raw workflow-expression interpolation Note before merging: this path only runs with real_op: true, so PR CI does not exercise it. The automation GitHub App must have contents write permission and any tag protection allowances previously granted to the ezrobot account. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The Create Tag workflow now keeps only its edition-specific data and delegates the mechanics to two composite actions in ibexa/gh-workflows: - check-composer-package (preparation) checks that the required package version is available on the Composer repository that composer update will actually consume — more accurate than the previous GitHub-tag probe, which could pass while the package was not yet installable; - create-metapackage-tag (action) fetches the release definition, derives minimum stability, pins the parent/assets packages, patches require versions, updates composer.lock and, with real_op, commits, tags and pushes using the GitHub App token. Behavior is unchanged apart from the more accurate preparation check and the dropped sponge/moreutils dependency. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Allows testing the new composite actions before the ibexa/gh-workflows pull request that introduces them is merged. Drop before merging. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
5 tasks
alongosz
marked this pull request as ready for review
August 5, 2026 15:05
alongosz
requested review from
Steveb-p,
ViniTou,
barw4,
bnowak,
ciastektk,
konradoboza,
mikadamczyk,
tbialcz and
wiewiurdp
August 5, 2026 15:23
konradoboza
approved these changes
Aug 6, 2026
Dropped when auto_tag logic was extracted into the shared check-composer-package/create-metapackage-tag composite actions. Composite action steps can't declare their own timeout-minutes, so the bound has to live on the job again.
bnowak
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Caution
Related PRs:
Description:
Rewrote
auto_tag.yml(Create Tag), 198 → 56 lines; for more details see ibexa/gh-workflows#105.Specific to headless:
headless-assetscheck now queries Satis, where that package is published — it is not on Packagist. The previous GitHub tag check could pass while Satis, rebuilt by a five-minute cron, had not yet indexed the tag.ibexa/headless-assets,ibexa/oss). The parentibexa/ossis on Packagist, so there is nothing to wait for.For QA:
The shared actions are tested in ibexa/gh-workflows#105 — see its For QA.
Test status:
🟢 Dry run at 4.6.31 (
real_op: false) from this branch, exercising the IBX-11778: Added composite actions for metapackage Create Tag workflows gh-workflows#105 actions via the[TMP]refs Create Tag run 31009050345 — preparation checkedibexa/headless-assetsin Satis with auth, bothibexa/headless-assetsandibexa/osspinned to 4.6.31, remaining requirements set from the release definition,composer.lockresolved, push step skipped, both jobs onubuntu-26.04🟢 Negative dry run at bogus version 9.9.9-test1 Create Tag run 31010164723 — preparation failed immediately with
::error::ibexa/headless-assets:v9.9.9-test1 is not available in https://updates.ibexa.coand theactionjob was skippedDocumentation:
No documentation required.
🤖 Generated with Claude Code