Use BOT_USER (eclipse-symphoy-bot) to checkout, commit, push changes in release pipeline

[msftcoderdjw]

Context:

https://github.com/eclipse-symphony/.eclipsefdn/pull/4

Suggestions by eclipse forks:

so I see that you request these changes in order to support your release workflow that fails now.

This is a common problem with github actions and can not be easily solved by a bypass rule for github actions, as there is no user like that.

However, what we have done for other projects and is also good practice is the following:

• inject a token as secret that allows to bypass the branch protection rule
• add the eclipse-symphoy-bot user to the bypass list (as already done in this PR)
• disable status checks as this is not compatible with direct pushes

• adapt your release workflow like that:

  • https://github.com/eclipse-xpanse/xpanse-ui/blob/main/.github/workflows/ui-release.yml#L18-L41
  • that uses the injected token for checkout that will also be used when you commit and push something
  • setup the commit information to the bot user which is then also visible in the commit history

so if I look at your existing release workflow, only a few things have to change:

• use then the injected token instead of secrets.GITHUB_TOKEN

• update our git config to use

  • BOT_USER_NAME: eclipse-symphony-bot
  • BOT_EMAIL_ID: symphony-bot@eclipse.org

Changes:

1. Use BOT_USER_NAME (eclipse-symphony-bot) to checkout, commit and push changes in release pipeline.
2. https://github.com/eclipse-symphony/.eclipsefdn/pull/4/files (eclipse-symphony-bot is added in bypass_pull_request_allowances list.)