From 982ae3332730ac15707b2bf918b5e682a8c5d1b3 Mon Sep 17 00:00:00 2001 From: Adarsh Prashar Date: Sat, 6 Jun 2026 18:07:58 +0530 Subject: [PATCH] ci: don't run the PR-review job on Dependabot PRs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The review job already skips fork PRs because repo secrets aren't exposed to them. Dependabot PRs hit the same wall — GitHub runs them with a restricted token and withholds secrets — but they come from a same-repo branch, so they passed the fork guard and ran anyway, failing every time on the missing CLAUDE_CODE_OAUTH_TOKEN. That painted a red X on otherwise green dependency bumps. Extend the guard to skip dependabot[bot] too (a clean skip, not a failure), and group the weekly CI Action bumps into a single PR so they're easier to review and merge together. --- .github/dependabot.yml | 5 +++++ .github/workflows/claude-pr-review.yml | 12 +++++++++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ec7ceae..041d625 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,3 +13,8 @@ updates: interval: weekly commit-message: prefix: "chore(ci)" + # Batch CI Action bumps into one weekly PR instead of one per action — they're + # low-risk and easier to review and merge together. + groups: + github-actions: + patterns: ["*"] diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml index ad1dcc5..5296c4c 100644 --- a/.github/workflows/claude-pr-review.yml +++ b/.github/workflows/claude-pr-review.yml @@ -22,9 +22,15 @@ permissions: jobs: review: - # Same-repo PRs only. On a fork PR head.repo.full_name differs from the repo, - # the secret is absent, and this job would always fail — so skip it there. - if: github.event.pull_request.head.repo.full_name == github.repository + # Same-repo, human-authored PRs only. On a fork PR head.repo.full_name differs + # from the repo; on a Dependabot PR the run gets a restricted token with no + # access to repo secrets. In both cases CLAUDE_CODE_OAUTH_TOKEN is absent and + # this job could only fail — so skip it (a clean skip, not a red X). Both are + # instead reviewed on demand: comment "@claude" (claude.yml runs in the base-repo + # context where the secret IS available). + if: >- + github.event.pull_request.head.repo.full_name == github.repository && + github.actor != 'dependabot[bot]' runs-on: ubuntu-latest steps: - uses: actions/checkout@v6