Background
`bump-develop-version.yml` is supposed to fire on `release: types: [published]` after a GA tag, open a PR against `develop` bumping `wheels.json` to the next-patch baseline, and unblock subsequent develop snapshots from re-using the just-shipped version string.
On the v4.0.0 GA today, the workflow did not fire even though the release was published.
Root cause
`release.yml`'s "Create GitHub Release" step uses `softprops/action-gh-release@v2.6.2` with the default `secrets.GITHUB_TOKEN`. Per the GitHub Actions documentation:
When you use the repository's `GITHUB_TOKEN` to perform tasks, events triggered by the `GITHUB_TOKEN`, with the exception of `workflow_dispatch` and `repository_dispatch`, will not create a new workflow run.
So the `release: published` event fires, but it doesn't get dispatched to other workflows.
What we tried during the v4.0.0 GA
- Toggling `Set as a pre-release` on/off via the GitHub web UI — no event dispatch
- `gh release edit v4.0.0 --prerelease` then `gh release edit v4.0.0 --prerelease=false` via CLI — also no dispatch. The release's `publishedAt` timestamp didn't update either, suggesting GitHub treats the round-trip as a no-op for event purposes.
Workaround applied: manual bump PR #2608.
Fix options
Three real candidates, lowest-friction first:
-
Switch `bump-develop-version.yml` to `repository_dispatch` — `release.yml` already fires `repository_dispatch` events with a custom PAT for the homebrew/scoop bumps (see the "Dispatch downstream package managers" step + `DOWNSTREAM_DISPATCH_TOKEN`). Add the develop-bump as a dispatch target in the same loop, change `bump-develop-version.yml` to listen for `repository_dispatch` with a known `event_type`. Re-uses the existing secret. No new auth surface.
-
Add `workflow_dispatch` to `bump-develop-version.yml` — gives the maintainer a manual button. Solves the immediate "I want to re-run after a missed event" problem but doesn't make the post-GA flow automatic.
-
Switch `release.yml`'s release-create step to use a PAT — `softprops/action-gh-release` with `token: ${{ secrets.SOME_PAT }}` instead of `GITHUB_TOKEN`. Most surface-changing of the three: the PAT needs `contents: write` on the repo and arguably some release-create permission, plus rotation discipline.
Recommended: option 1. `DOWNSTREAM_DISPATCH_TOKEN` already exists and is exercised on every GA; one more dispatch target is a minimal change.
Acceptance
Severity
Low — a manual bump PR (~30 seconds to draft) is a perfectly acceptable workaround. But this is exactly the kind of papercut that compounds across releases, and the v4.0.0 GA flagging it makes a good time to fix.
Related
Background
`bump-develop-version.yml` is supposed to fire on `release: types: [published]` after a GA tag, open a PR against `develop` bumping `wheels.json` to the next-patch baseline, and unblock subsequent develop snapshots from re-using the just-shipped version string.
On the v4.0.0 GA today, the workflow did not fire even though the release was published.
Root cause
`release.yml`'s "Create GitHub Release" step uses `softprops/action-gh-release@v2.6.2` with the default `secrets.GITHUB_TOKEN`. Per the GitHub Actions documentation:
So the `release: published` event fires, but it doesn't get dispatched to other workflows.
What we tried during the v4.0.0 GA
Workaround applied: manual bump PR #2608.
Fix options
Three real candidates, lowest-friction first:
Switch `bump-develop-version.yml` to `repository_dispatch` — `release.yml` already fires `repository_dispatch` events with a custom PAT for the homebrew/scoop bumps (see the "Dispatch downstream package managers" step + `DOWNSTREAM_DISPATCH_TOKEN`). Add the develop-bump as a dispatch target in the same loop, change `bump-develop-version.yml` to listen for `repository_dispatch` with a known `event_type`. Re-uses the existing secret. No new auth surface.
Add `workflow_dispatch` to `bump-develop-version.yml` — gives the maintainer a manual button. Solves the immediate "I want to re-run after a missed event" problem but doesn't make the post-GA flow automatic.
Switch `release.yml`'s release-create step to use a PAT — `softprops/action-gh-release` with `token: ${{ secrets.SOME_PAT }}` instead of `GITHUB_TOKEN`. Most surface-changing of the three: the PAT needs `contents: write` on the repo and arguably some release-create permission, plus rotation discipline.
Recommended: option 1. `DOWNSTREAM_DISPATCH_TOKEN` already exists and is exercised on every GA; one more dispatch target is a minimal change.
Acceptance
Severity
Low — a manual bump PR (~30 seconds to draft) is a perfectly acceptable workaround. But this is exactly the kind of papercut that compounds across releases, and the v4.0.0 GA flagging it makes a good time to fix.
Related