Skip dependabot-run steps that need Actions secrets - #666
Conversation
GitHub does not expose repository Actions secrets to pull_request runs triggered by Dependabot (same restriction as fork PRs), so FIXED_VERIFIER_PK, the TEST_* secrets, and TEMPLATES_MANAGER_TOKEN are all empty on every dependabot bump. deploy_changed_samples and check_samples are required status checks, so they fail every time and permanently block dependabot-automerge from merging any dependency PR (has been happening since at least July). Skip the secret-dependent steps for github.actor == 'dependabot[bot]' so the jobs report success (skipped) instead of failure. This changes nothing for human-authored or other-bot PRs, and dependabot PRs were never actually getting deploy/template coverage anyway since the secrets were always empty.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (2)
Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour. 📝 WalkthroughWalkthroughThe GitHub Actions workflows now skip template repository updates, staging deployments, and artifact uploads for Dependabot-triggered pull requests. ChangesDependabot workflow gates
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to The change limits secret-dependent workflow steps to Dependabot runs while preserving behavior for other pull requests; no actionable merge-blocking risk remains after normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.) Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
2 participants
Summary
pull_requestruns get no access to repo Actions secrets — GitHub applies the same restriction it does for fork PRs, to stop a malicious dependency bump from exfiltrating secrets.FIXED_VERIFIER_PK, everyTEST_*var, andTEMPLATES_MANAGER_TOKENare all empty in that context.deploy_changed_samples(Deploy Changed Samples) andcheck_samples(Check Samples) are both required status checks, and both fail every single dependabot PR because of this — e.g. runs 33447572730 and 33447572744 from PR chore(deps): bump engine.io and sails-hook-sockets in /samples/sailsjs-postgres/app #664 today. This has been happening on essentially every dependabot bump since at least July 21, and permanently blocksdependabot-automerge(.github/workflows/dependabot-automerge.yml) from ever merging anything — it approves and enables auto-merge, but the PR staysBLOCKEDforever on these two checks.github.actor == 'dependabot[bot]', so those jobs report success (skipped) instead of failure. Nothing changes for human-authored or other-bot PRs. Dependabot PRs weren't getting real deploy/template coverage from these steps anyway, since the secrets were always empty — this just stops that guaranteed failure from blocking merges.pull_request_targetto regain secret access — that would run dependency-bump code with full secrets, which is the exact supply-chain risk the current restriction exists to prevent.Longer-term option
If real deploy coverage for dependabot bumps is wanted, the supported path is duplicating the needed secrets into the repo's separate Dependabot secrets store (Settings → Secrets and variables → Dependabot) — that requires someone with secret-value access, which I don't have. Happy to file that as a follow-up if wanted.
Test plan
deploy_changed_samplesandcheck_samplesas passing (skipped) rather than failingdependabot-automergecan then actually merge a patch/minor bumpSummary by CodeRabbit