Accept and document github PAT parameter so autofix commits trigger workflows.

[wildbillcat]

Since this uses the native github token for writeback, it looks like when this action pushes a commit the other workflows don't run, likely to prevent recursive loops.
https://github.com/orgs/community/discussions/25702

Is there a way to pass a PAT instead of using standard GH token?

[czeise]

@wildbillcat - Could you provide an example of how this action is failing so we can produce it accurately and make sure that we're understanding the issue you're describing. Thanks!

[wildbillcat]

Sure thing, apologies for the delay, setting up a set project took me longer than expected. I have a sample public repository with an open PR here: wildbillcat/webhook_system#1
In this I run trufflehog and brakeman to scan my code and point out security issues, one of which. is failing:

When I add a subsequent commit to the branch so that standard detects issues and commits back to the repo. The security scans complete first while standard is still running:

But once standard completes, the autofixes are applied, and all the prior workflows are removed:

Based on the community post, it would seem that the GH token used to write back to the repo does not trigger any callbacks to GH workflows, so they don't get rerun. The work around folks appear to use is passing a parameter in with a personal access token for the write back, which then triggers the other workflows.

[jasonkarns]

The prior runs aren't "removed". (standard-ruby-action has no access or ability to do that) The runs from the prior commit are still attached to that commit:

(click the red X on prior commit to see prior checks)

GitHub's UI only shows checks that run against the PR's HEAD or MERGE_HEAD commits. Once there is a new commit on the branch, GitHub will only show the checks that are run against that commit. As you mentioned, any github activity whose actor is one of github's default tokens will not trigger additional workflows. So the workaround you mentioned will be necessary. Indeed, that case needs to be documented on this action and clarified how to pass a dedicated PAT which will trigger workflows.

(And even better, our action could detect when autofix is true and provide error/warning to ensure a PAT is also provided.)

I'll leave this issue open but re-word the title to clarify the need, if that's okay.