Skip to content

Skip dependabot-run steps that need Actions secrets #666

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
defangdevs merged 1 commit into from
Aug 31, 2026
Merged

Skip dependabot-run steps that need Actions secrets #666

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/workflows/check-sample.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,12 @@ jobs:

- name: Create / Update Template Repo
uses: actions/github-script@v7
# Dependabot-triggered pull_request runs get no access to Actions secrets
# (GitHub restricts this the same way it does for fork PRs), so
# TEMPLATES_MANAGER_TOKEN is empty here and this step would always fail.
# Skip it so the required check_samples check reports "success" (skipped)
# instead of blocking dependabot-automerge on every dependency bump.
if: github.actor != 'dependabot[bot]'
env:
PUSH_TOKEN: ${{ secrets.TEMPLATES_MANAGER_TOKEN }}
with:
Expand Down
8 changes: 6 additions & 2 deletions .github/workflows/deploy-changed-samples.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,11 @@ jobs:
- name: Deploy changed samples to staging
id: deploy-samples
shell: bash # implies set -o pipefail, so pipe below will keep the exit code from loadtest
if: env.should_continue == 'true'
# Dependabot-triggered pull_request runs get no access to Actions secrets
# (GitHub restricts this the same way it does for fork PRs), so this step
# would always fail here. Skip it so the required check reports "success"
# (skipped) instead of blocking dependabot-automerge on every bump.
if: env.should_continue == 'true' && github.actor != 'dependabot[bot]'
env:
FIXED_VERIFIER_PK: ${{ secrets.FIXED_VERIFIER_PK }}
TEST_ALLOWED_HOSTS: ${{ secrets.TEST_ALLOWED_HOSTS }}
Expand Down Expand Up @@ -134,7 +138,7 @@ jobs:
./tools/testing/loadtest -c fabric-staging.defang.dev:443 --timeout=15m --concurrency=10 -s $SAMPLES -o output --markdown=true | tee output/summary.log | grep -v '^\s*[-*]' # removes load sample log lines
- name: Upload Output as Artifact
uses: actions/upload-artifact@v4
if: env.should_continue == 'true' && (success() || steps.deploy-samples.outcome == 'failure') # Always upload result unless cancelled
if: env.should_continue == 'true' && github.actor != 'dependabot[bot]' && (success() || steps.deploy-samples.outcome == 'failure') # Always upload result unless cancelled
with:
name: program-output
path: output/**