我想在我的组织中创建一个 github 应用程序,它允许我在每个拉取请求合并到
main
分支后直接在主分支上创建自动版本控制提交。
我对 main
分支有一个分支保护规则,需要在合并之前发出拉取请求,并且我需要允许我的 github 应用程序绕过此规则。
这是我所做的步骤列表:
Permissions
Read access to codespaces metadata, metadata, organization events, and organization plan
Read and write access to Dependabot alerts, actions, actions variables, administration, attestations api, checks, code, codespaces, codespaces lifecycle admin, codespaces secrets, commit statuses, custom organization roles, custom repository roles, dependabot secrets, deployments, discussions, environments, issues, members, merge queues, organization actions variables, organization administration, organization announcement banners, organization codespaces, organization codespaces secrets, organization codespaces settings, organization copilot seat management, organization dependabot secrets, organization hooks, organization personal access token requests, organization personal access tokens, organization secrets, organization self hosted runners, organization user blocking, packages, pages, pull requests, repository advisories, repository custom properties, repository hooks, secret scanning alerts, secrets, security events, team discussions, and workflows
Admin access to organization custom properties, organization projects, and repository projects
"Allow specified actors to bypass required pull requests"
列表中peter-murray/workflow-application-token-action@v3
操作来生成具有足够权限来执行此操作的短期令牌):... prior workflow steps
- name: Get token for gh app Token
id: get_workflow_token
uses: peter-murray/workflow-application-token-action@v3
with:
application_id: ${{ vars.AUTOCOMMIT_APP_ID }}
application_private_key: ${{ secrets.AUTOCOMMIT_APP_PRIVATE_KEY }}
- name: Commit automatic version bump
if: github.event.pull_request.merged == true
env:
GITHUB_TOKEN: ${{ steps.get_workflow_token.outputs.token }}
run: |-
git config user.name 'autocommit app'
git config user.email '[email protected]'
git add .
git commit -m "chore: update version number (automated)"
git push
... later workflow steps
Run git config user.name 'autocommit app'
[main 27e4f11] chore: update version number (automated)
1 file changed, 1 insertion(+), 1 deletion(-)
remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: Review all repository rules at http://github.com/sandbox-org/org-sandbox-repo/rules?ref=refs%2Fheads%2Fmain
remote:
remote: - Changes must be made through a pull request.
remote:
To https://github.com/sandbox-org/org-sandbox-repo
! [remote rejected] main -> main (push declined due to repository rule violations)
error: failed to push some refs to 'https://github.com/sandbox-org/org-sandbox-repo'
如果我完全关闭分支保护,提交步骤工作得很好,所以我认为令牌创建是有效的,但这当然不是解决方案
当您使用 git 命令时,您可以对工作流程克隆的存储库进行操作。您的 git 配置使用 GitHub 为每个作业颁发的默认 GITHUB_TOKEN。未使用您为应用程序生成的令牌,因为 git 命令未使用环境变量。相反,git 查看 git 配置文件以获取由 actions/checkout 设置的 auth 标头。
您可以像这样覆盖您的远程源网址
htpps://${{ env.GITHUB_TOKEN }}@github.com/sandbox-org/org-sandbox-repo
或者您可以像 actions/checkout 一样更改 git config auth header。在“设置身份验证”下查看该操作的日志