aws / aws/bedrock-agentcore-sdk-python

CI pipeline does not trigger on release PRs created by github-actions[bot]

オープン
#370 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
主要言語
Python
スター
761
フォーク
147
平均マージ
1日 23時間
マージ済み PR(30日)
7

説明

## Problem

Release PRs (e.g. #369) created by the `release-prepare.yml` workflow never get their CI checks (`ci.yml`) triggered. This blocks merging because the `main-status-checks` ruleset requires 10 status checks to pass:

- Lint and Format
- Test Python 3.10, 3.11, 3.12, 3.13
- Build Distribution
- Test Package Installation (3.10, 3.11, 3.12, 3.13)

## Root Cause

`release-prepare.yml` uses the default `GITHUB_TOKEN` to push the release branch and create the PR. GitHub intentionally does **not** trigger workflows from events created by `GITHUB_TOKEN` to prevent infinite loops. Since the branch push and PR creation come from `github-actions[bot]`, the `pull_request` event for `ci.yml` is silently skipped.

References:
- https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow

## Secondary Issue

`pr-automerge.yml` checks for CI job names that don't match the actual names in `ci.yml`:

| pr-automerge.yml expects | ci.yml actual |
|---|---|
| `Lint` | `Lint and Format` |
| `Build Package` | `Build Distribution` |

Even if CI ran, the auto-merge would fail to find the correct check runs.

## Proposed Fix

### Option A: GitHub App token (recommended)

Use [`actions/create-github-app-token`](https://github.com/actions/create-github-app-token) in `release-prepare.yml` to generate a token from a GitHub App. Tokens from GitHub Apps **do** trigger downstream workflows.

```yaml
- name: Generate token
id: app-token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
```

Then use that token for the `git push` and `gh pr create` steps. This requires:
1. Creating a GitHub App with `contents: write` and `pull-requests: write` permissions
2. Installing it on the repo
3. Adding `APP_ID` and `APP_PRIVATE_KEY` as repo secrets

### Option B: Explicitly trigger CI (quick fix, no new secrets)

Add a step at the end of `release-prepare.yml` to manually trigger the CI workflow on the release branch:

```yaml
- name: Trigger CI on release branch
env:
GH_TOKEN: ${{ github.token }}
run: |
gh workflow run ci.yml --ref "release/v$NEW_VERSION"
```

This is simpler but is a workaround rather than a proper fix.

### Fix the name mismatch in pr-automerge.yml

Regardless of which option above is chosen, update the `requiredChecks` array in `pr-automerge.yml`:

```diff
const requiredChecks = [
- 'Lint',
+ 'Lint and Format',
'Test Python 3.10',
'Test Python 3.11',
'Test Python 3.12',
'Test Python 3.13',
- 'Build Package'
+ 'Build Distribution',
+ 'Test Package Installation (3.10)',
+ 'Test Package Installation (3.11)',
+ 'Test Package Installation (3.12)',
+ 'Test Package Installation (3.13)',
];
```

## Impact

Every release PR is affected. Currently requires manual intervention (pushing an empty commit or closing/reopening the PR) to trigger CI.

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

.github/workflows/release-prepare.yml、ci.yml、pr-automerge.yml を読み始めに確認し、次に release workflow がどのように自身のブランチを push して pull request を作成するかを追跡します。workflow のトリガー動作と必要な check 名を比較します。完了とは、release PR が必要な CI check をすべて受け取り、auto-merge が ci.yml で定義された check を認識することです。

索引モデルが issue の本文から書いたものです。

評価

技術スタック
github-actions
領域
ci-cd, devops
issue の種類
バグ
難易度
4/5
見積もり時間
3〜5日
活発さ
静か
明瞭さ
おおむね明確
初心者へのやさしさ
52/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。