# PSA: TagBot can’t tag & release commits that touch GitHub workflows

**URL:** https://discourse.julialang.org/t/psa-tagbot-can-t-tag-release-commits-that-touch-github-workflows/134532
**Category:** Tooling
**Tags:** github-actions, tagbot
**Created:** [December 13, 2025, 3:07pm UTC](https://discourse.julialang.org/t/psa-tagbot-can-t-tag-release-commits-that-touch-github-workflows/134532 "2025-12-13T15:07:07Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ianshmean](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/ianshmean/32/216042_2.png) [@ianshmean](https://discourse.julialang.org/u/ianshmean)
#### Post date: [December 13, 2025, 3:07pm UTC](https://discourse.julialang.org/t/psa-tagbot-can-t-tag-release-commits-that-touch-github-workflows/134532/1 "2025-12-13T15:07:07Z")

</div>

It turns out that a large source of TagBot’s puzzling intermittent failures may be because GitHub doesn’t like to make it easy to tag and release tags on commits that touch GitHub workflow files, and TagBot can’t do so (unless you give it a custom PAT). And GitHub’s errors don’t make it clear that that is why.

When it fails for that reason TagBot should now open an issue on the repo with guidance.

The best way to avoid it is to only release commits (via JuliaRegistrator etc.) that don’t touch workflow files.

The readme has updated info and guidance:

> **[GitHub - JuliaRegistries/TagBot: Creates tags, releases, and changelogs for your...](https://github.com/JuliaRegistries/TagBot)**
>
> Creates tags, releases, and changelogs for your Julia packages when they're registered

---

<div class="post-metadata">

### Author: ![ericphanson](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/ericphanson/32/215186_2.png) [@ericphanson](https://discourse.julialang.org/u/ericphanson)
#### Post date: [December 13, 2025, 4:43pm UTC](https://discourse.julialang.org/t/psa-tagbot-can-t-tag-release-commits-that-touch-github-workflows/134532/2 "2025-12-13T16:43:24Z")

</div>

Do you have any sense of what the danger is that GitHub is trying to prevent with this restriction?

---

<div class="post-metadata">

### Author: ![ianshmean](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/ianshmean/32/216042_2.png) [@ianshmean](https://discourse.julialang.org/u/ianshmean)
#### Post date: [December 13, 2025, 7:37pm UTC](https://discourse.julialang.org/t/psa-tagbot-can-t-tag-release-commits-that-touch-github-workflows/134532/3 "2025-12-13T19:37:44Z")

</div>

I don’t immediately see a reason why it’s less secure than what they allow (committing workflow changes then a version bump in a following commit).