IBX-11778: Updated deprecated GitHub Actions in auto_tag and nightly workflows

[alongosz]

Caution

• Drop TMP commits before merging

🎫 Issue	IBX-11778

Related PRs:

• IBX-11778: [GHA] Updated deprecated versions of GitHub actions gh-workflows#103
• IBX-11778: Added composite actions for metapackage Create Tag workflows gh-workflows#105
• IBX-11778: Updated deprecated GitHub Actions in auto_tag workflow commerce#1891
• IBX-11778: Updated deprecated GitHub Actions in auto_tag workflow experience#604
• IBX-11778: Updated deprecated GitHub Actions in auto_tag workflow headless#286

Description:

auto_tag.yml (Create Tag) ran several actions on the deprecated Node.js 20 runtime, which GitHub removes from its runners on 16 September 2026. Fixing that surfaced a second problem: the workflow was a ~200-line file copy-pasted across ibexa/oss, ibexa/headless, ibexa/experience and ibexa/commerce, with each edition's steps guarded by github.event.repository.name conditions — copies that had diverged anyway. Its mechanics now live in two reusable composite actions added in ibexa/gh-workflows#105, and the workflow keeps only this edition's data.

.github/workflows/auto_tag.yml in full, 206 → 50 lines:

name: Create Tag

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (x.y.z-abcN e.g. 4.5.6-beta1)'
        required: true
      real_op:
        description: 'Push changes'
        type: boolean
        default: false
        required: true
      git_push_args:
        description: 'For example: --force-with-lease'
        type: string
        default: ''
        required: false

jobs:
  preparation:
    runs-on: ubuntu-26.04

    steps:
      - name: Check for admin-ui-assets package
        uses: ibexa/gh-workflows/actions/check-composer-package@main
        with:
          package: ibexa/admin-ui-assets
          version: v${{ inputs.version }}

  action:
    needs: preparation
    runs-on: ubuntu-26.04

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set dependency versions, commit, tag and push
        uses: ibexa/gh-workflows/actions/create-metapackage-tag@main
        with:
          version: ${{ inputs.version }}
          pin-packages: ibexa/admin-ui-assets
          real-op: ${{ inputs.real_op }}
          git-push-args: ${{ inputs.git_push_args }}
          gh-client-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
          gh-client-secret: ${{ secrets.AUTOMATION_CLIENT_SECRET }}
          satis-network-key: ${{ secrets.SATIS_NETWORK_KEY }}
          satis-network-token: ${{ secrets.SATIS_NETWORK_TOKEN }}

The two actions:

• check-composer-package verifies that a package version is available in the Composer repository that composer update will actually consume. It replaces the previous GitHub tag-existence probe, which could pass while the package was not yet installable. With retry: true it re-checks on a schedule, for a parent package published while the release chain is running.
• create-metapackage-tag performs the tagging job: fetch releases/<version>/release.json from ibexa/release-maker, derive minimum stability from the version suffix, pin the parent and assets packages, patch the require versions from the release definition, refresh composer.lock and — only with real_op: true — commit, tag and push.

Behaviour changes beyond the deprecation fix:

• Release commits and tags are pushed with the automation GitHub App token instead of the legacy EZROBOT_PAT. Git is authenticated inside the step through gh auth setup-git, so no secret is written into the remote URL or .git/config, and the release commit is authored as github-actions[bot].
• nightly.yml: the octokit/request-action dispatch is now gh api --method POST, which also drops the !!str ref workaround, and create-github-app-token v3 receives client-id instead of the deprecated app-id.
• Removed along the way: the steps guarded by other editions' repository names, the unused cs2pr tool and the sponge/moreutils dependency.

Runners are ubuntu-26.04 and actions/checkout is v7. The remaining workflows in this repository only call ibexa/gh-workflows/...@main reusable workflows and needed no changes.

The uses: references above read @main; the [TMP] commit in this pull request points them at the gh-workflows feature branch so the actions can be exercised before it is merged.

For QA:

No manual QA required. The Create Tag workflow can be validated by dispatching it with real_op: false (dry run — no tag is pushed) once a suitable release.json exists in ibexa/release-maker. The nightly trigger can be validated by dispatching Nightly browser tests manually.

Before merging: the Commit, tag and push path only runs with real_op: true, so PR CI does not exercise it — verify the automation GitHub App has contents write permission and any tag protection allowances previously granted to the ezrobot account.

Documentation:

No documentation required.

🤖 Generated with Claude Code