IBX-11778: Updated deprecated GitHub Actions in auto_tag workflow

[alongosz]

Caution

• Drop TMP commits before merging

🎫 Issue	IBX-11778

Related PRs:

• IBX-11778: [GHA] Updated deprecated versions of GitHub actions gh-workflows#103
• IBX-11778: Added composite actions for metapackage Create Tag workflows gh-workflows#105
• IBX-11778: Updated deprecated GitHub Actions in auto_tag workflow experience#604
• IBX-11778: Updated deprecated GitHub Actions in auto_tag workflow headless#286
• IBX-11778: Updated deprecated GitHub Actions in auto_tag and nightly workflows oss#285

Description:

auto_tag.yml (Create Tag) ran several actions on the deprecated Node.js 20 runtime, which GitHub removes from its runners on 16 September 2026. Fixing that surfaced a second problem: the workflow was a ~200-line file copy-pasted across ibexa/oss, ibexa/headless, ibexa/experience and ibexa/commerce, with each edition's steps guarded by github.event.repository.name conditions — copies that had diverged anyway. Its mechanics now live in two reusable composite actions added in ibexa/gh-workflows#105, and the workflow keeps only this edition's data.

.github/workflows/auto_tag.yml in full, 199 → 58 lines:

name: Create Tag

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (x.y.z-abcN e.g. 4.5.6-beta1)'
        required: true
      real_op:
        description: 'Push changes'
        type: boolean
        default: false
        required: true
      git_push_args:
        description: 'For example: --force-with-lease'
        type: string
        default: ''
        required: false

jobs:
  preparation:
    runs-on: ubuntu-26.04
    # This should allow parallel runs in a chain, e.g. OSS->Headless->Experience->Commerce
    # whilst allowing Satis to process (rebuilt by cron every 5 minutes;
    # the retry schedule re-checks for up to ~28.5 minutes)
    timeout-minutes: 30

    steps:
      - name: Wait for parent package ibexa/experience to be available in Satis
        uses: ibexa/gh-workflows/actions/check-composer-package@main
        with:
          package: ibexa/experience
          version: v${{ inputs.version }}
          repository-url: https://updates.ibexa.co
          auth-key: ${{ secrets.SATIS_NETWORK_KEY }}
          auth-token: ${{ secrets.SATIS_NETWORK_TOKEN }}
          retry: true

  action:
    needs: preparation
    runs-on: ubuntu-26.04

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set dependency versions, commit, tag and push
        uses: ibexa/gh-workflows/actions/create-metapackage-tag@main
        with:
          version: ${{ inputs.version }}
          pin-packages: ibexa/experience
          real-op: ${{ inputs.real_op }}
          git-push-args: ${{ inputs.git_push_args }}
          gh-client-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
          gh-client-secret: ${{ secrets.AUTOMATION_CLIENT_SECRET }}
          satis-network-key: ${{ secrets.SATIS_NETWORK_KEY }}
          satis-network-token: ${{ secrets.SATIS_NETWORK_TOKEN }}

The two actions:

• check-composer-package verifies that a package version is available in the Composer repository that composer update will actually consume. It replaces the previous GitHub tag-existence probe, which could pass while the package was not yet installable. With retry: true it re-checks on a schedule, for a parent package published while the release chain is running.
• create-metapackage-tag performs the tagging job: fetch releases/<version>/release.json from ibexa/release-maker, derive minimum stability from the version suffix, pin the parent and assets packages, patch the require versions from the release definition, refresh composer.lock and — only with real_op: true — commit, tag and push.

Behaviour changes beyond the deprecation fix:

• Release commits and tags are pushed with the automation GitHub App token instead of the legacy EZROBOT_PAT. Git is authenticated inside the step through gh auth setup-git, so no secret is written into the remote URL or .git/config, and the release commit is authored as github-actions[bot].
• The wait for the parent package in Satis is fixed. Previously the for loop's exit status masked the check result, so the step could never fail, and its final backoff sleep overran the 30-minute job timeout. check-composer-package with retry: true re-checks on the Satis cron cadence (30/60/120 s, then 5 × 300 s), stays within the timeout, and fails with an explicit error when the version never appears.
• Removed along the way: the steps guarded by other editions' repository names, the unused cs2pr tool and the sponge/moreutils dependency.

Runners are ubuntu-26.04 and actions/checkout is v7. The other workflows in this repository only call ibexa/gh-workflows/...@main reusable workflows and needed no changes.

The uses: references above read @main; the [TMP] commit in this pull request points them at the gh-workflows feature branch so the actions can be exercised before it is merged.

For QA:

No manual QA required. The workflow can be validated by dispatching Create Tag with real_op: false (dry run — no tag is pushed) once a suitable release.json exists in ibexa/release-maker.

Before merging: the Commit, tag and push path only runs with real_op: true, so PR CI does not exercise it — verify the automation GitHub App has contents write permission and any tag protection allowances previously granted to the ezrobot account.

Documentation:

No documentation required.

🤖 Generated with Claude Code