release-on-merge doesn't trigger build-image #497

New issue

Closed

opened 2026-09-07 16:53:46 +02:00 by johnsturgeon · 0 comments

johnsturgeon commented

2026-09-07 16:53:46 +02:00

Owner

Summary

When a bump PR merges, release-on-merge.yml creates the release correctly, but build-image.yml never runs, so no image is pushed for the new version. Production ends up a release behind.

Observed

PR #496 (Release 2.32.0) merged.
release-on-merge.yml ran green and created release 2.32.0 (target 0ea2ffb).
build-image.yml did not run at all — no build-and-push run for the release event.
Confirmed the 2.32.0 image was missing from the registry until manually dispatched.

Root cause

Forgejo (matching GitHub) suppresses new workflow runs from any event triggered by the built-in Actions token, to prevent recursive runs.

The chain is:

PR merges -> release-on-merge.yml -> creates release -> release:published -> build-image.yml

release-on-merge.yml authenticates as secrets.FJ_TOKEN || secrets.GITHUB_TOKEN. FJ_TOKEN is not set, so it falls back to the built-in token. That token can write the release (so creation succeeds), but because the built-in token created it, the release:published event is suppressed and build-image.yml is never triggered.

The intent was already documented in .forgejo/workflows/build-image.yml:

release-on-merge.yml must create that release with a real PAT; the built-in token would not trigger a run.

The missing piece is the PAT itself.

Fix

Create a Forgejo PAT with write:repository scope.
Add it as an Actions secret named FJ_TOKEN (user-level, matching how FJ_API_URL is set). No workflow code change needed — release-on-merge.yml already prefers FJ_TOKEN over the built-in token.
Verify on the next bump PR: build-image.yml should run on its own with event release (not workflow_dispatch).

Fallback if it still doesn't chain

Some Forgejo versions do not emit a release event for releases created via the REST API, even under a PAT. If the chain still doesn't fire after the PAT is in place, add an explicit dispatch as the last step of release-on-merge.yml (still under the PAT), removing the dependency on event chaining:

api -X POST -H 'Content-Type: application/json' -d '{"ref":"main"}' \
    "$repo/actions/workflows/build-image.yml/dispatches"

Workaround used now

Dispatched build-image.yml manually (workflow_dispatch, ref main) to build and push the 2.32.0 image.

Side effect to note

claude.yml and claude-code-review.yml share the same FJ_TOKEN || GITHUB_TOKEN fallback. Once FJ_TOKEN is set, their comments will be attributed to the PAT's user instead of the actions bot — cosmetic only.

## Summary When a bump PR merges, `release-on-merge.yml` creates the release correctly, but `build-image.yml` never runs, so no image is pushed for the new version. Production ends up a release behind. ## Observed - PR #496 (Release 2.32.0) merged. - `release-on-merge.yml` ran green and created release `2.32.0` (target `0ea2ffb`). - `build-image.yml` did **not** run at all — no `build-and-push` run for the release event. - Confirmed the `2.32.0` image was missing from the registry until manually dispatched. ## Root cause Forgejo (matching GitHub) suppresses new workflow runs from any event triggered by the **built-in Actions token**, to prevent recursive runs. The chain is: ``` PR merges -> release-on-merge.yml -> creates release -> release:published -> build-image.yml ``` `release-on-merge.yml` authenticates as `secrets.FJ_TOKEN || secrets.GITHUB_TOKEN`. `FJ_TOKEN` is not set, so it falls back to the built-in token. That token can write the release (so creation succeeds), but because the built-in token created it, the `release:published` event is suppressed and `build-image.yml` is never triggered. The intent was already documented in `.forgejo/workflows/build-image.yml`: > release-on-merge.yml must create that release with a real PAT; the built-in token would not trigger a run. The missing piece is the PAT itself. ## Fix 1. Create a Forgejo PAT with `write:repository` scope. 2. Add it as an Actions secret named `FJ_TOKEN` (user-level, matching how `FJ_API_URL` is set). No workflow code change needed — `release-on-merge.yml` already prefers `FJ_TOKEN` over the built-in token. 3. Verify on the next bump PR: `build-image.yml` should run on its own with event `release` (not `workflow_dispatch`). ### Fallback if it still doesn't chain Some Forgejo versions do not emit a `release` event for releases created via the REST API, even under a PAT. If the chain still doesn't fire after the PAT is in place, add an explicit dispatch as the last step of `release-on-merge.yml` (still under the PAT), removing the dependency on event chaining: ```bash api -X POST -H 'Content-Type: application/json' -d '{"ref":"main"}' \ "$repo/actions/workflows/build-image.yml/dispatches" ``` ## Workaround used now Dispatched `build-image.yml` manually (`workflow_dispatch`, ref `main`) to build and push the `2.32.0` image. ## Side effect to note `claude.yml` and `claude-code-review.yml` share the same `FJ_TOKEN || GITHUB_TOKEN` fallback. Once `FJ_TOKEN` is set, their comments will be attributed to the PAT's user instead of the actions bot — cosmetic only.

johnsturgeon changed title from ~~release-on-merge doesn't trigger build-image (release created by built-in token)~~ to release-on-merge doesn't trigger build-image

2026-09-07 16:54:26 +02:00

johnsturgeon referenced this issue from a commit

2026-09-07 16:58:48 +02:00

Release 2.32.1

johnsturgeon referenced this issue from a pull request that will close it,

2026-09-07 16:58:54 +02:00

Release 2.32.1 #498

johnsturgeon closed this issue

2026-09-07 17:04:24 +02:00