Pushing to a protected branch while preventing infinite loop

[omri-shilton]

I have a protected branch dev and i have a workflow that runs when you push to this branch (through PR of course).
I need to commit files into the same branch (Helm charts for GitOps).
When using the default github token i get an error that i cannot push to protected branch.
When using a PAT i created, it works but also creates an infinite loop of workflow triggers.

I though about enabling force push to this branch for specific user ( machine user ) but all the examples i see online require giving the machine user PAT to the workflow which may lead to the same issue.

Thanks for the help in advance!

[stefanzweifel]

The best way to protect you from infinite loops is to add a guard to your workflows.
In previous discussion I shared this snippet which inspects the commit message of the last commit.

name: Deploy

on:
    push:

jobs:
    deploy:
        name: Deploy
        runs-on: ubuntu-latest
        # Run this job if the commit message is not equal to "::your-commit-message::"
        if: github.event.head_commit.message != '::your-commit-message::'
        steps:
            - run: # Deploy code

If your commit message is not static, you can of course change the guard to look for a different values.
You could for example change commit_user_email, commit_user_name or commit_author in git-auto-commit and then inspect github.event.head_commit.pusher.name and guard your workflow accordingly.

You can find the entire object structure of github.event here: https://docs.github.com/en/webhooks-and-events/webhooks/webhook-events-and-payloads#push

Related Discussions:

• disable workflow on protected branch #271 (comment)
• workflow triggers itself on push #237 (comment)

[omri-shilton]

Actually I solved it by adding [skip-ci] to the commit message of the auto-commit.

[stefanzweifel]

Oh! That's a very good idea. And so much easier to implement.
Will add this to the docs.