# \[ANN\] The TagBot GitHub App is deprecated in favour of the TagBot GitHub Action

**URL:** <https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344>\
**Category:** Tooling\
**Tags:** tagbot\
**Created:** [February 8, 2020, 12:52pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344 "2020-02-08T12:52:16Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![mauro3](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/mauro3/32/292_2.png) [@mauro3](https://discourse.julialang.org/u/mauro3)\
**Post date:** [February 8, 2020, 9:31pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/21 "2020-02-08T21:31:35Z")

</div>

Should I uninstall the old TabBot App once all the Action PR are merged?

---

<div class="post-metadata">

**Author:** ![dlfivefifty](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/dlfivefifty/32/1959_2.png) [@dlfivefifty](https://discourse.julialang.org/u/dlfivefifty)\
**Post date:** [February 8, 2020, 10:16pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/22 "2020-02-08T22:16:23Z")

</div>

I’m seeing the same thing. Here’s a link to an example error: [https://github.com/JuliaApproximation/ApproxFunIntrospect.jl/commit/66e666b25f043f991c2a223bd099c3bd1e4cc422/checks?check\_suite\_id=446140216](https://github.com/JuliaApproximation/ApproxFunIntrospect.jl/commit/66e666b25f043f991c2a223bd099c3bd1e4cc422/checks?check_suite_id=446140216)

---

<div class="post-metadata">

**Author:** ![dilumaluthge](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/dilumaluthge/32/29283_2.png) [@dilumaluthge](https://discourse.julialang.org/u/dilumaluthge)\
**Post date:** [February 8, 2020, 10:39pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/23 "2020-02-08T22:39:44Z")

</div>

Alright @dlfivefifty @rdeits the error seems to arise if your repository does not have a `Project.toml` file.

The two solutions are:

1. Add a `Project.toml` file to your repository.
2. Delete the `.github/workflows/TagBot.yml` file from your repository.

---

<div class="post-metadata">

**Author:** ![dlfivefifty](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/dlfivefifty/32/1959_2.png) [@dlfivefifty](https://discourse.julialang.org/u/dlfivefifty)\
**Post date:** [February 8, 2020, 10:49pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/24 "2020-02-08T22:49:03Z")

</div>

I think this is clearly a bug In the Action and should be corrected. Mass PRs are generally frowned upon, as it creates undesired work for a lot of people. Adding in extra steps to work around a bug in the PR is a step too far.

---

<div class="post-metadata">

**Author:** ![dilumaluthge](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/dilumaluthge/32/29283_2.png) [@dilumaluthge](https://discourse.julialang.org/u/dilumaluthge)\
**Post date:** [February 8, 2020, 10:49pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/25 "2020-02-08T22:49:55Z")

</div>

To be fair, `REQUIRE` files have been deprecated and discouraged for a long time.

---

<div class="post-metadata">

**Author:** ![dlfivefifty](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/dlfivefifty/32/1959_2.png) [@dlfivefifty](https://discourse.julialang.org/u/dlfivefifty)\
**Post date:** [February 8, 2020, 10:53pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/26 "2020-02-08T22:53:18Z")

</div>

Some of the repositories haven’t been touched since Julia v0.5. Don’t put in a PR to a defunct repository that doesn’t take into account it’s not valid on Julia v1.0… It’s equivalent to putting a PR into a Python repository, which also doesn’t have a Project.toml file

---

<div class="post-metadata">

**Author:** ![christopher-dG](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/christopher-dg/32/7387_2.png) [@christopher-dG](https://discourse.julialang.org/u/christopher-dG)\
**Post date:** [February 9, 2020, 2:08am UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/27 "2020-02-09T02:08:08Z")

</div>

Ok, I’ll try to address everything in order:

> [@tim.holy](#):
>
> And presumably we could do maintenance via the `MassInstallAction.jl` you linked above?

Yeah I think so. I’m not sure that it handles updates, but it could be made to do so.

> [@giordano](#):
>
> Out of curiosity, does this trigger a download of Julia every hour?

This was already discussed, but some additional information: Even if it were in Julia, it’s a Docker image so the Julia download would only be at build time. So users would not download Julia, they would download a Docker image that has Julia preinstalled.

> [@dilumaluthge](#):
>
> It does seem like a missed opportunity to eat our own dog food.

I would have liked to have written it in Julia,.

But I’ll be totally honest: Python is objectively better for this stuff _right now_. I’m not saying Julia won’t be a better general purpose language one day in the future (I really want it to be!) but changelog template support would be far worse without Jinja, and GPG password support would not exist without python-gnupg. In its current state, TagBot finishes its run before a Julia-implemented TagBot would finish compiling stuff. Obviously performance is less important when it’s running in the background without your knowledge, but hey, with potentially 2000 jobs every hour I think that the energy savings are substantial. I’ve gotta make up for the huge number of CI jobs I triggered yesterday… 🙃

Also, my dev experience has been far better. Because the code is basically one giant ball of side effects, testing it is really hard without a good, convenient mocking library and `unittest.mock` is far ahead of Julia alternatives (I say this as someone who maintains [a mocking library](https://github.com/christopher-dG/SimpleMock.jl)!). The test suite with ~100% coverage, static analysis, lint checking, and format checking takes less than 3 seconds. I’d imagine the Julia equivalent to take minutes.

In the future, you probably could rewrite it in Julia and be successful; it’s only ~600 LOC.

> [@rdeits](#):
>
> It looks like TagBot fails and sends an email every half hour for every Julia project that doesn’t have a Project.toml?? How do I make this stop?

This was an oversight by me. I’m sorry. I disabled those emails on my own account a long time ago and I totally forgot that they were a thing.  
I also didn’t really expect the PR to be merged by any really old packages that don’t have a Project.toml, and I didn’t explain that thoroughly enough above.  
To be clear now: TagBot is only for “modern” packages that want to be registered in a registry. If your package is being developed and registered presently, you should definitely have a `Project.toml`. If it’s not, you should not bother installing TagBot.  
I’ve updated TagBot to no longer error in this case.

> [@mauro3](#):
>
> Should I uninstall the old TabBot App once all the Action PR are merged?

You can if you want, it’s a good idea because it immediately revokes my access to your packages through the App. But if you don’t, the App will still not run on your packages because it checks first to see if the Action is set up.

---

<div class="post-metadata">

**Author:** ![tkf](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/tkf/32/17635_2.png) [@tkf](https://discourse.julialang.org/u/tkf)\
**Post date:** [February 9, 2020, 2:32am UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/28 "2020-02-09T02:32:09Z")

</div>

Old TagBot had [this list of issue/PR labels for excluding items from the changelog](https://github.com/JuliaRegistries/TagBot/blob/45c63403cbb72aaf23958b18c0ca439c25e8658a/README.md#release-notes):

> When using the automatic changelog, you can ensure that certain issues or pull requests are not included.  
> These might include usage questions or typo fixes that aren’t worth mentioning.  
> To exclude an issue or PR, add a label to it with one of the following values:
> 
> - `changelog skip`
> - `duplicate`
> - `exclude from changelog`
> - `invalid`
> - `no changelog`
> - `question`
> - `wont fix`
> 
> You can spell these in a few different ways.  
> For example, `no changelog` could be `nochangelog`, `no-changelog`, `no_changelog`, `No Changelog`, `NoChangelog`, `No-Changelog`, or `No_Changelog`.

However, IIUC, it looks like the latest TagBot supports only `changelog-skip`:

> <https://github.com/JuliaRegistries/TagBot/blob/v1.5.3/action.yml#L49>

Can you add back all the previously supported labels?

Edit: posted as an issue [Are labels like `no changelog` supported in GitHub Action? · Issue #57 · JuliaRegistries/TagBot · GitHub](https://github.com/JuliaRegistries/TagBot/issues/57)

---

<div class="post-metadata">

**Author:** ![staticfloat](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/staticfloat/32/34_2.png) [@staticfloat](https://discourse.julialang.org/u/staticfloat)\
**Post date:** [February 9, 2020, 8:27am UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/29 "2020-02-09T08:27:48Z")

</div>

Just as an aside; we do now have caching infrastructure in place in many cloud hosting providers (including those that GH actions run inside of) that allow us to pay O(1) monthly costs for downloads within those datacenters. If you happen to launch an incredibly popular bot that runs in a new datacenter, we will just add a caching server in that datacenter. So don’t let download cost dissuade you from building cool infrastructure! I do happen to agree with Christopher that Python is a great tool for this purpose though; some pieces of the Julia caching infrastructure are written in Python for exactly these reasons. That decision boundary is moving, but it’s a bit of a slog with a few major technical hurdles in the way. 🙂

---

<div class="post-metadata">

**Author:** ![lostella](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/lostella/32/356_2.png) [@lostella](https://discourse.julialang.org/u/lostella)\
**Post date:** [February 9, 2020, 1:47pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/30 "2020-02-09T13:47:15Z")

</div>

So once we merge all PRs, or enable the action manually on all Julia repositories, we can safely revoke the permissions granted on an org to the TagBot app?

---

<div class="post-metadata">

**Author:** ![Tamas\_Papp](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/tamas_papp/32/25949_2.png) [@Tamas\_Papp](https://discourse.julialang.org/u/Tamas_Papp)\
**Post date:** [February 9, 2020, 1:57pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/31 "2020-02-09T13:57:38Z")

</div>

I very much appreciate all the work that was put into this, and the help with the transition.

However, having a lot of Julia repositories, this morning I found hundreds of notifications in my mailbox.

I would like to suggest that the next time someone wants to make thousands of automated PRs, they consider

1. an on-demand option with package-level granularity (type the Github `username/repo.jl` into a web form, get a PR)
2. an on-demand option with user-level granularity (all Julia repos for that user/organization get such a PR).

---

<div class="post-metadata">

**Author:** ![chakravala](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/chakravala/32/6832_2.png) [@chakravala](https://discourse.julialang.org/u/chakravala)\
**Post date:** [February 9, 2020, 2:45pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/32 "2020-02-09T14:45:14Z")

</div>

> [@ccoffrin](#):
>
> Do we have high confidence that Github won’t change the spec of the actions yml file?

Recently the `.travis.yml` configuration file had [deprecating changes](https://discourse.julialang.org/t/travis-ci-configuration-breaking-changes/34268), probably a rare occurrence.

Personally, I am choosing not to rely on Github actions, as I don’t want to depend on Github.

But this is not a problem for me, since tagging manually doesn’t bother me.

---

<div class="post-metadata">

**Author:** ![bjarthur](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/bjarthur/32/9638_2.png) [@bjarthur](https://discourse.julialang.org/u/bjarthur)\
**Post date:** [February 9, 2020, 6:18pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/33 "2020-02-09T18:18:40Z")

</div>

it’s really unfortunate the github does not permit apps to send notifications to each other. if it did, then JuliaRegistrator could tell TagBot when to run, instead the latter being cron’d.

---

<div class="post-metadata">

**Author:** ![tim.holy](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/tim.holy/32/52_2.png) [@tim.holy](https://discourse.julialang.org/u/tim.holy)\
**Post date:** [February 9, 2020, 9:07pm UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/34 "2020-02-09T21:07:56Z")

</div>

Couldn’t agree more. Honestly, I can’t imagine it will last this way. `inotify` got invented because polling is awful. I predict that within 6 months they’ll have fixed this.

---

<div class="post-metadata">

**Author:** ![christopher-dG](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/christopher-dg/32/7387_2.png) [@christopher-dG](https://discourse.julialang.org/u/christopher-dG)\
**Post date:** [February 10, 2020, 2:29am UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/35 "2020-02-10T02:29:05Z")

</div>

> [@lostella](#):
>
> So once we merge all PRs, or enable the action manually on all Julia repositories, we can safely revoke the permissions granted on an org to the TagBot app?

Yes you can.

> [@Tamas\_Papp](#):
>
> I would like to suggest that the next time someone wants to make thousands of automated PRs, they consider […]

Absolutely, I was actually thinking the same thing for future migrations. Sorry for the inconvenience!

> [@bjarthur](#):
>
> it’s really unfortunate the github does not permit apps to send notifications to each other.

Yeah, this was the original wanted design but it’s not possible right now, probably for security reasons. I hope they’ll figure something out!

---

<div class="post-metadata">

**Author:** ![c42f](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/c42f/32/52842_2.png) [@c42f](https://discourse.julialang.org/u/c42f)\
**Post date:** [February 10, 2020, 6:46am UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/36 "2020-02-10T06:46:01Z")

</div>

> [@christopher-dG](#):
>
> If you’re using GitHub Actions for your documentation deploys (or any other on-tag event): You need to add a different access token or SSH key to make those builds trigger to give you per-version hosted docs

I’d prefer to use an ssh deploy key rather than a personal access token, but I’m a bit confused about how and whether this will work. Is the problem that the tagbot action can’t trigger a new build for the tag using the github API? In that case I don’t see how the ssh key can help.

---

<div class="post-metadata">

**Author:** ![fredrikekre](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/fredrikekre/32/1688_2.png) [@fredrikekre](https://discourse.julialang.org/u/fredrikekre)\
**Post date:** [February 10, 2020, 9:20am UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/37 "2020-02-10T09:20:15Z")

</div>

The problem is that GitHub does not allow an action to trigger another action. However, if you as a user (e.g. with SSH key) authorize the push, then the doc-building action will trigger. However, if you are not using a user authorization for pushing the docs, then the gh-pages page build (which is also an action) is not triggered, see [GitHub Pages build not triggered with GITHUB\_TOKEN · Issue #1177 · JuliaDocs/Documenter.jl · GitHub](https://github.com/JuliaDocs/Documenter.jl/issues/1177).

---

<div class="post-metadata">

**Author:** ![tkf](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/tkf/32/17635_2.png) [@tkf](https://discourse.julialang.org/u/tkf)\
**Post date:** [February 10, 2020, 9:44am UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/38 "2020-02-10T09:44:01Z")

</div>

There is a chain of GitHub workflows: TagBot → Documenter → gh-pages. IIUC, SSH key (`DOCUMENTER_KEY`) is only relevant for Documenter → gh-pages. For TagBot → Documenter, I suppose you need to setup a custom token in `TagBot.yml` (like this: [Use custom token in .github/workflows/TagBot.yml by tkf · Pull Request #13 · JuliaTesting/PerformanceTestTools.jl · GitHub](https://github.com/tkf/PerformanceTestTools.jl/pull/13/commits/f0730c06f4f3f757696581fe53fa5b97b1b0b213) )?

---

<div class="post-metadata">

**Author:** ![fredrikekre](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/fredrikekre/32/1688_2.png) [@fredrikekre](https://discourse.julialang.org/u/fredrikekre)\
**Post date:** [February 10, 2020, 9:47am UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/39 "2020-02-10T09:47:51Z")

</div>

You can use a SSH deploy key for TagBot too ([GitHub - JuliaRegistries/TagBot: Creates tags, releases, and changelogs for your Julia packages when they're registered](https://github.com/JuliaRegistries/TagBot#ssh-deploy-keys)), can even use the same as for Documenter. I think this is a better approach since access tokens are not limited to one repo like SSH keys.

---

<div class="post-metadata">

**Author:** ![tkf](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/tkf/32/17635_2.png) [@tkf](https://discourse.julialang.org/u/tkf)\
**Post date:** [February 10, 2020, 9:51am UTC](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344/40 "2020-02-10T09:51:15Z")

</div>

I didn’t know that TagBot supports SSH key. Thanks for the clarification.

[Previous page](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344.md?page=1)

[Next page](https://discourse.julialang.org/t/ann-the-tagbot-github-app-is-deprecated-in-favour-of-the-tagbot-github-action/34344.md?page=3)