Release action: Wait for checks before ff-merge

[LogFlames]

Release action does not wait for required checks before trying to merge release branch into main branch. This causes the merge to fail and it must be done manually.

See #747.

[LogFlames]

This could be a good option: https://github.com/marketplace/actions/wait-for-checks, although it only has 26 stars and might be an unneeded dependency.

Might be better to use github-script and check it usings github's API. More work to keep updated, but less risk off hijacking.

[LogFlames]

Github actions were not allowed to create PRs which would trigger the CI to run. This option can be enabled but seems to have some security problems which is why it is disabled by default. Will explore other options.

[LogFlames]

Some progress, by adding the maven-lockfile generation before committing the tagged release and before commiting "setting snapshot version" no chore: lockfile would be needed on the new branch. Previously all releases tagged vx.y.z would contain the lockfile for vx.y.(z-1)-SNAPSHOT and the new lockfile would be added in a commit directly after the tagged one.

This was bad both because the tagged commit did not contain the lockfile used when building the release (all packages would be correct but the version number would be invalid), and because we got a bunch of chore: lockfile commits in the main branch.

It still is not able to override the branch protection rules. Even though it should push using the JRELEASER_GITHUB_TOKEN which I think should have admin permissions and should therefore be able to override the ruleset.

[LogFlames]

I have verified that this works in a personal repository: https://github.com/LogFlames/branch-protection-tests.

Because of a merging error it didn't actually use the JRELEASER_GITHUB_TOKEN but still used the GITHUB_TOKEN without admin access. Third time's the charm :)

[LogFlames]

There seems to be some difference in permission between my local repository. In the local repository it is able to overwrite the branch protection rules using a PAT. Maybe my access token for the chains-project organization does not have enough permissions.

Will try with a classic token instead.

[LogFlames]

Classic token also didn't work.

I will try to summarize the problem:

On my local machine I can run git merge --ff-only release/5.3.3 && git push origin main and get the following output:

❯ git merge --ff-only origin/release/5.3.3
Updating 8dfab42..e29ca30
Fast-forward
 CHANGELOG.md                | 7 +++++++
 action.yml                  | 2 +-
 github_action/lockfile.json | 2 +-
 github_action/pom.xml       | 4 ++--
 lockfile.json               | 2 +-
 maven_plugin/lockfile.json  | 2 +-
 maven_plugin/pom.xml        | 4 ++--
 pom.xml                     | 4 ++--
 8 files changed, 17 insertions(+), 10 deletions(-)
❯ git push
Total 0 (delta 0), reused 0 (delta 0), pack-reused 0
remote: Bypassed rule violations for refs/heads/main:
remote:
remote: - 4 of 4 required status checks are expected.
remote:
To github.com:chains-project/maven-lockfile.git
   8dfab42..e29ca30  main -> main

But when the Release action runs the same commands it gets the following output:

Fast-forward
 CHANGELOG.md                | 7 +++++++
 action.yml                  | 2 +-
 github_action/lockfile.json | 2 +-
 github_action/pom.xml       | 4 ++--
 lockfile.json               | 2 +-
 maven_plugin/lockfile.json  | 2 +-
 maven_plugin/pom.xml        | 4 ++--
 pom.xml                     | 4 ++--
 8 files changed, 17 insertions(+), 10 deletions(-)
remote: error: GH013: Repository rule violations found for refs/heads/main.        
remote: Review all repository rules at https://github.com/chains-project/maven-lockfile/rules?ref=refs%2Fheads%2Fmain        
remote: 
remote: - 4 of 4 required status checks are expected.        
remote: 
To https://github.com/chains-project/maven-lockfile
 ! [remote rejected] main -> main (push declined due to repository rule violations)
error: failed to push some refs to 'https://github.com/chains-project/maven-lockfile'
Error: Process completed with exit code 1.

Even though it should be authenticated using my access token which should have the same permissions as I have.

When I set my remote url to be https://x-access-token:[TOKEN]@github.com/chains-project/maven-lockfile.git I can bypass the branch protection rules. So the token should not be the problem and I then assume that the action does not use the token, even though that should be the only url it can push to. Have to read more about the checkout action (which also uses the classic token to clone the repository) and figure out why the action is not using the token.

[LogFlames]

First successfull Release-run 🎉
https://github.com/chains-project/maven-lockfile/actions/runs/12432099550