Protected branch with PR requirement prevents release

[Ninerian]

Hello we integrated semantic release in our tool chain, but as we tried to release to master the first time, the branch protection of master prevented the release.

The error message from travis:

[9:32:50 AM] [semantic-release] › ✖  An error occurred while running semantic-release: { Error: Command failed: git push --tags https://[secure]@github.com/**/service.git HEAD:master
remote: error: GH006: Protected branch update failed for refs/heads/master.        
remote: error: At least 1 approving review is required by reviewers with write access.        
To https://github.com/**/service.git
 ! [remote rejected] HEAD -> master (protected branch hook declined)
error: failed to push some refs to 'https://[secure]@github.com/**/service.git'

How could I keep the PR rule and enable semantic release?

[gr2m]

Hmm that’s odd, I did not run into it myself. Does the configured GITHUB_TOKEN have write access to the repository? Do you have any custom configuration for semantic-release in your setup?

[diegopamio]

We are facing exactly the same issue.

[cgadam]

@gr2m even though you might have write access for protected branches you need to pass all the required checks (like having a PR and having, 2 approvers, etc) in order to be able to merge to master unless you are admin. We don't want our bot to have such privilege so if instead of committing directly to the repo it would be nice if we could create a PR. That should fix this situation.

[gr2m]

semantic-release is not merging or pushing anything by default, it just creates a git tag. I don’t think that is prohibited by the branch protection.

I think what might be possible is that you have configured something which requires the creation of additional commits, hence my question about custom configuration

[cgadam]

@gr2m you are right. The one trying to commit is actually the npm plugin that changes the context the package.json with the new version. There is also another plugin that changes the context of the CHANGELOG.md file. It then needs to push that to the release branch (master in this case)

[gr2m]

I’m not sure if these features are implemented in this plugin or somewhere else? I’m not sure how where the feature would need to be implemented, but if you want to give it a go I can help review it

[cgadam]

@Ninerian, the situation we have which I think it's similar to yours is this one:

• We have protected branch rules enabled (like having 2 reviewers per each commit and do not commit directly to master if it's not via a PR). The protected branch is, at the same time, the release branch for semantic-release. (i.e: master)

• We want semantic-release to update files when the new version is calculated. (In our case we do update package.json and CHANGELOG.md file). In order to do this you need to provide a GITHUB_TOKEN with write permissions.

You will still get the issue you described before.

[9:32:50 AM] [semantic-release] › ✖  An error occurred while running semantic-release: { Error: Command failed: git push --tags https://[secure]@github.com/**/service.git HEAD:master
remote: error: GH006: Protected branch update failed for refs/heads/master.        
remote: error: At least 1 approving review is required by reviewers with write access.        
To https://github.com/**/service.git
 ! [remote rejected] HEAD -> master (protected branch hook declined)
error: failed to push some refs to 'https://[secure]@github.com/**/service.git'

In the perfect world, we would be able to tell Github, please bypass this type of checking for specific non-admin users (like a bot) but that's something Github doesn't support so far. I have confirmed it with support:

The way we workaround this was by assigning the bot as Owner. By doing this it do has the power to bypass the protected branch rules (because it's considered an admin).

The good thing is that the GITHUB_TOKEN we generated for doing this kind of commit doesn't have any crazy permission like deleting repo or such so we should be OK.

Hope this is useful to you too and helps u with semantic-release integration on your protected branch.

[Ninerian]

After some research I have to admit that I had the wrong package installed. I used semantic-release/git. after changing to this plugin, the release works flawless.

[good-idea]

In case others come here with the same issue - I was having this problem, but fixed it by un-checking "Include administrators" in the branch protection rule.

[hashim-sohail]

After some research I have to admit that I had the wrong package installed. I used semantic-release/git. after changing to this plugin, the release works flawless.

How were you able to fix this issue?

[goloroden]

@Ninerian Great that you figured out how to solve this 🎉

Can you maybe shed some light on how to combine the @semantic-release/git plugin with branch protection, and on how you solved it?

[hashim-sohail]

@Ninerian Great that you figured out how to solve this 🎉

Can you maybe shed some light on how to combine the @semantic-release/git plugin with branch protection, and on how you solved it?

I was also able to resolve the protection issue using GIT_CREDENTIALS as my environment variable.

Environment Variables

But instead of using my password i used a Personal Access Token of an admin account with push access to the repos

[goloroden]

Hey @hashim-sohail 👋

Thanks for the quick reply!

How do you protect these credentials against malicious PRs who read your environment variables and send them somewhere?

Oh, and have you enabled branch protection? If so, did you setup the token with administrative privileges?

[goloroden]

PS: I'm asking since https://github.com/semantic-release/semantic-release/blob/f645547f2f30eb59179f1d22da13612ba5090f38/docs/recipes/github-actions.md#pushing-packagejson-changes-to-a-master-branch warns not to use personal access tokens. I'm a little bit puzzled here.

On the one hand, the docs advise you to use a personal access token, on the other hand they tell you not to do as it imposes a security risk...