CI workflow (on pull_request and event opened) is not getting triggered when a new PR is opened by a dispatch workflow

[radhikari-arch]

Hi,
I have this case where a status check set was on a branch policy which is a CI that I am expecting to run when PR is opened. Well, this works when I open the PR manually, but not when PR was opened by a dispatch workflow.
I have a dispatch workflow create_pr.yml that creates a PR with some inputs:
create_pr.yml

name: Create PR
on:

workflow_dispatch:

inputs:

......
jobs:

create_pr:

name: Create PR test

runs-on: [self-hosted, dev]
steps:
  .......
  - name: Create a working branch and push repo
    run: |
      git pull && git checkout -b automation/ticket1234
      ## Add/change files
      .....
      git add -A &&
      git commit -m "Github Automated Workflow - deployment file added" &&
      git push -u origin automation/ticket1234

   - name: Create a Pull Request
      uses: actions/github-script@v6
    with:
      script: |
        const result = await github.rest.pulls.create({
          title: 'Create resource',
          owner: context.repo.owner,
          repo: context.repo.repo,
          head: 'automation/ticket1243',
          base: 'development',
          body: [
              'test body',
              'line 2'
          ].join('\n')
        });

And I have a CI workflow. ci.yml, that runs on following different events of pull requests. I have this CI added into the status check for the “development” branch policy. All other pull request events works fine once the PR is opened that triggers the ci.yml workflow and sends the status check to the PR. However, the status check keeps on waiting when the PR is first open and the workflow does not get triggered.
ci.yml

name: CI - Check terraform plan
on:

pull_request:

types: [opened, reopened, synchronize, ready_for_review, labeled, review_requested, edited]

branches:

- 'development'

paths:

- '**.tf'

...

I tried the workflow_call on the CI and called it from the create_pr.yml workflow, howevere the context of the opened PR is not passed. So that is not going to work for me. So how can I make the CI run as soon as the PR was opened. Only workaround I have now is that CR gets triggered whenever I changed other events on the PR after it is created, like adding labels, edit, add reviewers or put in and out of draft mode.

[radhikari-arch]

This is what it looks like when a PR is opened by workflow dispatch, and CI won’t run until I change other events, like add a label or put in and out of draft etc. I am looking for a way so that CI ci.yml is run as soon as the PR was created by dispatch workflow create_pr,yml.

image947×285 20 KB

[jsoref]

<a href="https://github.community/t/githhub-acitons-push-event-not-triggered-if-githubactions-bot-enabled-auto-merge/238439/2">GithHub Acitons: Push Event not triggered if githubactions[bot] enabled Auto merge</a> <a class="badge-wrapper  bullet" href="/c/code-to-cloud/github-actions/41"><span class="badge-category-parent-bg" style="background-color: #6a737d;"></span><span class="badge-category-bg" style="background-color: #2188ff;"></span><span style="" data-drop-close="true" class="badge-category clear-badge" title="Discussion and questions about GitHub Actions—automation for all of your development workflows, now with world-class CI/CD.">GitHub Actions</span></a>

Correct. This is by design

If you want to trigger something, you’ll need to use a:

  <a href="https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token" target="_blank" rel="noopener">GitHub Docs</a>

Creating a personal access token - GitHub Docs

You should create a personal access token to use in place of a password with the command line or with the API.

[InDieTasten]

The page link you provided as "by design" does not indicate anything about GITHUB_TOKEN being unable to trigger other workflows, and subsequently also doesn't make any statements that would tell us whether it's by design or not.

[radhikari-arch]

Yes, I had that PAT used, I had it redacted from the original post. Here is the create_pr.yml and ci.yml again. Expectation here is ci.yml to run as soon as create_pr.yml completes that creates a new PR. ci.yml is on the branch check status and shows “waiting” and only runs until other events are triggered on the PR manually.
Do I need to pass any permissions as showsn here: Automatic token authentication - GitHub Docs
If so what exact permissions are needed.

create_pr.yml

name: Create PR
on:

workflow_dispatch:

inputs:

......
jobs:

create_pr:

name: Create PR test

runs-on: [self-hosted, dev]
steps:
  .......
  - name: Setup Git Config
    run:
      git config --global url."https://oauth2:${GH_TOKEN}@github.com/MY-ORG".insteadOf "https://github.com/MY-ORG"
    env:
      GH_TOKEN: "${{ secrets.MY_PAT }}"

  - name: repo checkout
    uses: actions/checkout@v2
    with:
      token: "${{ secrets.MY_PAT }}"
      ref: 'development'

  - name: Create a working branch and push repo
    run: |
      git pull && git checkout -b automation/ticket1234
      ## Add/change files
      .....
      git add -A &&
      git commit -m "Github Automated Workflow - deployment file added" &&
      git push -u origin automation/ticket1234

   - name: Create a Pull Request
      uses: actions/github-script@v6
    with:
      script: |
        const result = await github.rest.pulls.create({
          title: 'Create resource',
          owner: context.repo.owner,
          repo: context.repo.repo,
          head: 'automation/ticket1243',
          base: 'development',
          body: [
              'test body',
              'line 2'
          ].join('\n')
        });

And, ci.yml

name: CI - Check terraform plan
on:

pull_request:

types: [opened, reopened, synchronize, ready_for_review, labeled, review_requested, edited]

branches:

- 'development'

paths:

- '**.tf'

...

[airtower-luna]

You don’t need the PAT for the Git operations at all, you need it when creating the PR. And the actions/github-script step doesn’t see the token stored in the Git configuration, you need to provide it as described in the documentation:

  <a href="https://github.com/actions/github-script#using-a-separate-github-token" target="_blank" rel="noopener">GitHub</a>

GitHub - actions/github-script: Write workflows scripting the GitHub API in...

Write workflows scripting the GitHub API in JavaScript - GitHub - actions/github-script: Write workflows scripting the GitHub API in JavaScript

I recommend you remove the PAT from the Git config to minimize available privileges. The GITHUB_TOKEN should be sufficient there, unless you also want to trigger workflows on push or something.

[InDieTasten]

I don't get why this was marked as the answer. The initial question was exactly about why "on: pr" is not triggered, when a PR is created by "github-actions (bot)", aka the GITHUB_TOKEN.

OP is able to create the PR. The issue is, he cannot merge it without build validation workflows being initiated

[radhikari-arch]

Thanks, this resolved my issue. I removed the token from create_pr.yml workflow and then passed MY_PAT only at the actions/ github-scripts step. That executed the CI when the pr got opened.

[thalysonalexr]

what permissions did you pass to the token?

[jsoref]

Do note that PATs should be stored in secrets – not committed into the repository.

[InDieTasten]

The following place in the docs explain this behavior:

When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN, with the exception of workflow_dispatch and repository_dispatch, will not create a new workflow run. This prevents you from accidentally creating recursive workflow runs. For example, if a workflow run pushes code using the repository's GITHUB_TOKEN, a new workflow will not run even when the repository contains a workflow configured to run when push events occur.

Commits pushed by a GitHub Actions workflow that uses the GITHUB_TOKEN do not trigger a GitHub Pages build.

Source: https://docs.github.com/en/actions/concepts/security/github_token#when-github_token-triggers-workflow-runs