With new release automation, container images workflow is no longer trigged by tag creation

[tuminoid]

After #734 was merged, release tags are created by this workflow. This means build-images-action is no longer triggering by tag creation, due Github side security precaution to avoid loops.

We need to fix it. Some ideas:

• workflow_run - change the triggering mechanism, issue is how the tag data is passed
• workflow_dispatch - maybe we change both a bit so uses: can be integrated as part of release

It does not seem that adding more permissions like actions: write etc helps.

[tuminoid]

Ping @mquhuy

[Rozzii]

/triage accepted
/kind feature

[Rozzii]

/kind bug

[tuminoid]

/reopen

[metal3-io-bot]

@tuminoid: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[tuminoid]

/assign @mquhuy

[tuminoid]

workflow_run cannot use the data from triggering workflow by any dot syntax, see this Github documentation

It has example and states that it must use another step to upload an artifact with wanted data, and then the new workflow must load it. This issue is mentioned in the description. workflow_run is limited versus workflow_dispatch (more commony used) due security restrictions (dispatch actively calls a workflow, while run just self-triggers on another jobs).

So, we might want to consider adding the image build directly into release workflow as then it can use inputs directly (with the price of some duplication in image building code), or add the artifact upload/download to the image build, to pass the ref information.