The "second push" (force_ci_trigger()) incorrectly pushes to the HTTPS remote, and as a result, Github Actions CI is not started for CompatHelper PRs

[benegee]

We are using CompatHelper.jl for our flow solver project Trixi.jl. However, since some time, our CI workflow does not start anymore for PRs opened by github-actions bot triggered by CompatHelper.

We are using the workflow file linked on https://github.com/JuliaRegistries/CompatHelper.jl. We also use Documenter.jl and have DOCUMENTER_KEY set up as suggested. Our current workaround is to just close and reopen the PR, which then triggers CI. We also tried with a new Documenter key, which however did not help.

Do have any idea what could be in the way?

[gbruer15]

It may be related to this issue of workflow runs can't be triggered by processes authenticated with the repository's GITHUB_TOKEN: https://github.com/orgs/community/discussions/57484

Was the CompatHelper job automatically triggering the workflows in the past?

[benegee]

It may be related to this issue of workflow runs can't be triggered by processes authenticated with the repository's GITHUB_TOKEN: https://github.com/orgs/community/discussions/57484

Yes, this makes sense. But isn't that the reason to have a DOCUMENTER_KEY as well?

Was the CompatHelper job automatically triggering the workflows in the past?

Yes, it used to work in the past.

[gbruer15]

Ah yes, I forgot that's what the key was for. Then I also have this issue, and I don't know how to fix it. I've tried some things below that could help, but it still didn't work.

Background: I'm on a Github Enterprise with a self-hosted runner.

I believe something isn't work in this part of the code:

CompatHelper.jl/src/utilities/git.jl

Lines 34 to 41 in e72bd6b

	ssh = enable_ssh_verbose_b ? "ssh -vvvv" : "ssh"
	git_ssh_command = isnothing(pkey_filename) ? ssh : "$(ssh) -i $pkey_filename"
	env2 = copy(ENV)
	env2["GIT_SSH_COMMAND"] = git_ssh_command
	cmd = `git -c user.name="$name" -c user.email="$email" -c committer.name="$name" -c committer.email="$email" push $force_flag $remote $branch`
	@debug "Attempting to run Git push command" cmd env2["GIT_SSH_COMMAND"]
	run(setenv(cmd, env2))

I edited my workflow file to enable debug for CompatHelper and ssh like this:

      - name: "Run CompatHelper"
        run: |
          import CompatHelper
          CompatHelper.main()
        shell: julia --color=yes {0}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          COMPATHELPER_PRIV: ${{ secrets.DOCUMENTER_KEY }}
          JULIA_DEBUG: CompatHelper
          JULIA_COMPATHELPER_ENABLE_SSH_VERBOSE: true

According to the advice here, the workflow must run on push, so I modified my CI workflow to run on main and compathelper/**:

name: CI
on:
  pull_request:
    types: [opened, ready_for_review, synchronize]
  push:
    branches:
    - main
    - 'compathelper/**'

I also tried modifying CompatHelper.jl to add -o IdentitiesOnly=yes per this post's suggestion to ensure it is using the deploy key instead of some default ssh key on the machine:

    git_ssh_command = isnothing(pkey_filename) ? ssh : "$(ssh) -i $pkey_filename -o IdentitiesOnly=yes"

When I run the workflow, the debug lines show what command is being run, but I don't get any verbose ssh output.

┌ Debug: Attempting to run Git push command
│   cmd = `git -c 'user.name=CompatHelper Julia' -c [email protected] -c 'committer.name=CompatHelper Julia' -c [email protected] push -f origin compathelper/new_version/2024-07-26-18-26-18-322-03422250780`
│   env2["GIT_SSH_COMMAND"] = "ssh -vvvv -i /tmp/jl_kNDBcL/privatekey -o IdentitiesOnly=yes"

If I run locally, then

GIT_SSH_COMMAND="ssh -vvvv -i /tmp/jl_kNDBcL/privatekey -o IdentitiesOnly=yes" git pull

successfully pulls and prints verbose ssh info while

GIT_SSH_COMMAND="ssh -vvvv -o IdentitiesOnly=yes" git pull

errors due to insufficient permisions but still prints the verbose ssh info, so I know the private key file works.

Since the verbose ssh info isn't showing up when I run the Github workflow, it must not be using the GIT_SSH_COMMAND that it tries to use.

[penelopeysm]

@gbruer15 is correct, GIT_SSH_COMMAND is not being used at all, because the remote URL is https (thus git does not use ssh at all).

I've made PR #505 with a fix.