Automatic patch release tagging broken

[emteknetnz]

Tag rulesets were added in this issue #198

Automatic patch tagging is broken in gha-ci e.g.

• https://github.com/silverstripe/silverstripe-framework/actions/runs/9310253996/job/25627638607
• https://github.com/silverstripe/silverstripe-userforms/actions/runs/9296099134/job/25584233072

Unable to create release for tag 5.2.10 - HTTP response code was 422
{
  "message": "Validation Failed",
  "errors": [
    {
      "resource": "Release",
      "code": "custom",
      "field": "pre_receive",
      "message": "pre_receive Repository rule violations found\n\nCannot create ref due to create name restrictions.\n\n"
    },
    {
      "resource": "Release",
      "code": "custom",
      "message": "Published releases must have a valid tag"
    }
  ],
  "documentation_url": "https://docs.github.com/rest/releases/releases#create-a-release"
}

Notes

• Github docs on tag protection rules
• Gihut docs on assigning permissions to jobs
• The github-actions user has contents: write permissions in this context https://github.com/silverstripe/gha-ci/blob/1/.github/workflows/ci.yml#L1010 which was working prior to the tag ruleset being added
• When testing the github-actions bypass permissions for module-standardiser this workflow was tested that uses gha-tag-release

New issues created

• Reimplement branch protection rules that had to be removed #260

PR

• ENH Remove restrict creations rule for tag ruleset module-standardiser#55

[emteknetnz]

I suspect I did faulty testing originally to validate that the github-actions user has bypass permissions, I've retested and looks like it actually has no bypass permissions at all, not even write despite it have contents: write permission on the workflow

I've tested that unticking the "tag creation" check allows the gha-tag-release to create tags and releases, so in the short-term we should update module-standardiser to apply that rule

[GuySartorelli]

Reassigning to Steve to run standardiser

[emteknetnz]

Have updated, and also re-run ci workflows in issue description, things are working correclty