From 5080d91aecedc515cc079c3b11451465f4c79e62 Mon Sep 17 00:00:00 2001
From: defangdevs <defangdevs@users.noreply.github.com>
Date: Mon, 31 Aug 2026 15:47:37 -0700
Subject: [PATCH] Skip dependabot-run steps that need Actions secrets

GitHub does not expose repository Actions secrets to pull_request runs
triggered by Dependabot (same restriction as fork PRs), so
FIXED_VERIFIER_PK, the TEST_* secrets, and TEMPLATES_MANAGER_TOKEN are
all empty on every dependabot bump. deploy_changed_samples and
check_samples are required status checks, so they fail every time and
permanently block dependabot-automerge from merging any dependency PR
(has been happening since at least July).

Skip the secret-dependent steps for github.actor == 'dependabot[bot]'
so the jobs report success (skipped) instead of failure. This changes
nothing for human-authored or other-bot PRs, and dependabot PRs were
never actually getting deploy/template coverage anyway since the
secrets were always empty.
---
 .github/workflows/check-sample.yml           | 6 ++++++
 .github/workflows/deploy-changed-samples.yml | 8 ++++++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/check-sample.yml b/.github/workflows/check-sample.yml
index 5579a2b91..011313394 100644
--- a/.github/workflows/check-sample.yml
+++ b/.github/workflows/check-sample.yml
@@ -59,6 +59,12 @@ jobs:
 
       - name: Create / Update Template Repo
         uses: actions/github-script@v7
+        # Dependabot-triggered pull_request runs get no access to Actions secrets
+        # (GitHub restricts this the same way it does for fork PRs), so
+        # TEMPLATES_MANAGER_TOKEN is empty here and this step would always fail.
+        # Skip it so the required check_samples check reports "success" (skipped)
+        # instead of blocking dependabot-automerge on every dependency bump.
+        if: github.actor != 'dependabot[bot]'
         env:
           PUSH_TOKEN: ${{ secrets.TEMPLATES_MANAGER_TOKEN }}
         with:
diff --git a/.github/workflows/deploy-changed-samples.yml b/.github/workflows/deploy-changed-samples.yml
index 80d7a7512..e2a9b6785 100644
--- a/.github/workflows/deploy-changed-samples.yml
+++ b/.github/workflows/deploy-changed-samples.yml
@@ -69,7 +69,11 @@ jobs:
       - name: Deploy changed samples to staging
         id: deploy-samples
         shell: bash # implies set -o pipefail, so pipe below will keep the exit code from loadtest
-        if: env.should_continue == 'true'
+        # Dependabot-triggered pull_request runs get no access to Actions secrets
+        # (GitHub restricts this the same way it does for fork PRs), so this step
+        # would always fail here. Skip it so the required check reports "success"
+        # (skipped) instead of blocking dependabot-automerge on every bump.
+        if: env.should_continue == 'true' && github.actor != 'dependabot[bot]'
         env:
           FIXED_VERIFIER_PK: ${{ secrets.FIXED_VERIFIER_PK }}
           TEST_ALLOWED_HOSTS: ${{ secrets.TEST_ALLOWED_HOSTS }}
@@ -134,7 +138,7 @@ jobs:
           ./tools/testing/loadtest -c fabric-staging.defang.dev:443 --timeout=15m --concurrency=10 -s $SAMPLES -o output --markdown=true | tee output/summary.log | grep -v '^\s*[-*]' # removes load sample log lines
       - name: Upload Output as Artifact
         uses: actions/upload-artifact@v4
-        if: env.should_continue == 'true' && (success() || steps.deploy-samples.outcome == 'failure') # Always upload result unless cancelled
+        if: env.should_continue == 'true' && github.actor != 'dependabot[bot]' && (success() || steps.deploy-samples.outcome == 'failure') # Always upload result unless cancelled
         with:
           name: program-output
           path: output/**