MSIME-Windows#121 records that CI cannot be made a required check here, because release-please's
pull request never gets one: GITHUB_TOKEN may not start workflows, so the pull_request run is
created in action_required and waits for a human forever.
I previously wrote on that issue that the only way out was a GitHub App or PAT. That was wrong.
workflow_dispatch is the exception GitHub allows GITHUB_TOKEN to fire, and MSIME-Apple's release
automation has been relying on it all along. Checked its release branch: workflow_dispatch runs
exist there and succeed, alongside pull_request runs that do not.
Also checked the two alternatives that looked cheaper, and neither works:
- A push trigger on release-please--** produces nothing. Every run on that branch in MSIME-Linux
is a pull_request event; a GITHUB_TOKEN push creates no run at all. MSIME-Linux#31 merged on
the belief that it does.
- The approval policy is not the cause. All six repositories are already on
first_time_contributors_new_to_github, the loosest setting, and bot-triggered runs are still
gated. Comparing runs, the gate tracks triggering_actor exactly: github-actions[bot] gives
action_required, houko gives success.
So merge-release-pr.sh now dispatches ci.yml on the release branch, polls for the run at that exact
head commit, and waits for it with --exit-status before merging. The checks land on the pull
request's head commit, which is what required_status_checks needs.
It also re-reads main and the pull request head afterwards: main can advance during a build, and
merging then would rebase the release commit onto something that was never tested.
ci.yml gains workflow_dispatch so it can be dispatched at all. The paths-ignore stays: it keeps the
unapprovable pull_request run out of the checks list, leaving only the dispatched run's results,
which avoids two check runs with the same name and different outcomes on one commit.
The prepare job gains actions: write, without which gh workflow run cannot dispatch.
Evan Hu
b02e4c8cc9