This action does not create GitHub releases, making it incompatible with Renovate #182

Activity

1. Rumbles commented on Jun 11, 2026

   

   Rumbles

   on Jun 11, 2026

   More actions

   We chased this from the Renovate side and turned up something worth adding here, since the symptom ("Renovate can't see versions for this action") can have a cause other than the missing releases.

   We opened #244 to add GitHub Releases for exactly this issue, but while debugging we found our actual failure was not the missing releases — so we've now closed #244 (we no longer need it).

   What we saw: Renovate's github-tags lookup for databricks/setup-cli intermittently returned no-result, which made Renovate autoclose the version-bump PR every time the datasource cache went cold (open on one run, autoclosed on the next).

   The logs showed the real cause — not a missing release, but an access block:

   Although you appear to have the correct authorization credentials, the
   `databricks` organization has an IP allow list enabled, and your IP
   address is not permitted to access this resource.
       at GithubGraphqlDatasourceFetcher.doRawQuery (.../util/github/graphql/datasource-fetcher.ts)
       at queryTags                                  (.../util/github/graphql/index.ts)
       at GithubTagsDatasource.getReleases           (.../modules/datasource/github-tags/index.ts)
   

   So the databricks org has a GitHub IP allow list enabled, and it was rejecting our Renovate runner's API calls to databricks/*. This bites hosted Renovate (Mend) in particular: the Renovate GitHub App is installed on the databricks org too, so its token is governed by that org's allow list, and the hosted runner IPs aren't on it.

   Worth noting: github-tags resolves tags fine without any GitHub Releases when the lookup isn't IP-blocked (we verified the tags are fully readable via the API from a non-blocked identity). So for us the releases gap wasn't the blocker. The missing-releases problem in this issue is still real and separate — it affects changelog/release-notes rendering and the github-releases datasource — but anyone landing here because of a Renovate no-result may actually be hitting the IP allow list rather than the missing releases.

   How we worked around it: we stopped using hosted Renovate for the affected repo and self-host Renovate (renovatebot/github-action) authenticated with a PAT owned by an account that is not a member of the databricks org. That token isn't subject to databricks' org IP allow list, so the public-repo tag lookups resolve reliably.

   Leaving this as a data point for anyone else who gets here via no-result.