Release action not triggered when tag is created by another GitHub Action
Description
When running make release from the kubeshark repo's Makefile, the automatic tagging step succeeds but fails to trigger the downstream release GitHub Action. The release action that should fire on new tag creation does not execute because the tag was pushed by a GitHub Action using the default GITHUB_TOKEN.
Root cause: GitHub Actions triggered by the default GITHUB_TOKEN do not trigger other workflows. This is a deliberate GitHub limitation to prevent recursive workflow runs. When the Makefile's release process pushes a new tag via a GitHub Action, the tag creation event is attributed to the github-actions bot, and GitHub skips triggering any subsequent workflows (including the release action).
Fix: Replace the default GITHUB_TOKEN with a Personal Access Token (PAT) for the tag push step. A PAT-authenticated push is treated as a regular user action and will trigger downstream workflows (e.g., the release action on tag publish).
Steps to Reproduce
- Run
make release(or the equivalent tag-and-push step) from a GitHub Action - Observe that the new tag is created successfully
- Observe that the release workflow (triggered by tag publish) does not run
- Manually pushing the same tag from a local machine triggers the release correctly
Expected Behavior
When a new tag is published as part of a GitHub Action, the release workflow should be triggered and a GitHub release should be created automatically — same as when the tag is pushed manually.
Environment
- Repo: kubeshark/kubeshark
- Trigger: Makefile
releasetarget via GitHub Actions
Source: kubeshark/kubeshark