From ebb0f18b2c54fea4e8914077b04180e1614f2ab9 Mon Sep 17 00:00:00 2001 From: Dan Draper Date: Sun, 19 Jul 2026 15:49:19 +1000 Subject: [PATCH] ci: skip secret-consuming live jobs on Dependabot PRs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot PRs branch from this repo, so the existing fork gate (`head.repo.full_name == github.repository`) is TRUE for them and the live integration / e2e jobs run. But Dependabot PRs execute under the *Dependabot* secret store, which is a separate, narrower set than the Actions secrets — it carries the `CS_*` credentials but not the identity suites' `CLERK_MACHINE_TOKEN`. The lock-context integration suite throws (by design — "fail, never skip", so a green skip can't hide a regression) when that token is missing, so every Dependabot PR that touches an integration trigger path hard-fails a job the bot cannot fix (e.g. #689, a dev-dependency bump touching `packages/test-kit/**`). Give Dependabot PRs the same clean skip fork PRs already get, by adding `github.actor != 'dependabot[bot]'` to the job gate on all five secret-consuming workflows (integration-drizzle / -supabase / -prisma-next, prisma-next-e2e, prisma-example-readme-e2e). A skipped required job reports success, so the PR is no longer blocked; `tests.yml` + the frozen-lockfile checks remain the real signal for a dependency bump. Not running live, secret-backed jobs on semi-trusted Dependabot PRs is also the supply-chain-safer default. Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w --- .github/workflows/integration-drizzle.yml | 7 ++++++- .github/workflows/integration-prisma-next.yml | 6 +++++- .github/workflows/integration-supabase.yml | 6 +++++- .github/workflows/prisma-example-readme-e2e.yml | 5 ++++- .github/workflows/prisma-next-e2e.yml | 7 +++++-- 5 files changed, 25 insertions(+), 6 deletions(-) diff --git a/.github/workflows/integration-drizzle.yml b/.github/workflows/integration-drizzle.yml index 3db687917..a37605f80 100644 --- a/.github/workflows/integration-drizzle.yml +++ b/.github/workflows/integration-drizzle.yml @@ -76,7 +76,12 @@ jobs: cancel-in-progress: false # Fork PRs have no secrets. Skip cleanly rather than fail on something the # contributor cannot fix — `tests.yml` still gives them a green signal. - if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }} + # Dependabot PRs are skipped for the same reason: they run under the + # Dependabot secret store, which does not carry the identity suites' + # CLERK_MACHINE_TOKEN, so the lock-context suite would fail-loud (by design + # it throws rather than skips) on a change Dependabot cannot fix. A + # dependency bump's real signal is `tests.yml` + the lockfile checks. + if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }} strategy: fail-fast: false diff --git a/.github/workflows/integration-prisma-next.yml b/.github/workflows/integration-prisma-next.yml index 55eb9585b..bc75206c6 100644 --- a/.github/workflows/integration-prisma-next.yml +++ b/.github/workflows/integration-prisma-next.yml @@ -65,7 +65,11 @@ jobs: cancel-in-progress: false # Fork PRs have no secrets. Skip cleanly rather than fail on something the # contributor cannot fix — `tests.yml` still gives them a green signal. - if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }} + # Dependabot PRs skip for the same reason: they run under the Dependabot + # secret store (a distinct, narrower set), so a secret-consuming live suite + # can fail on a change Dependabot cannot fix. A dependency bump's real + # signal is `tests.yml` + the lockfile checks. + if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }} strategy: fail-fast: false diff --git a/.github/workflows/integration-supabase.yml b/.github/workflows/integration-supabase.yml index 64252ff59..d5a56aa5e 100644 --- a/.github/workflows/integration-supabase.yml +++ b/.github/workflows/integration-supabase.yml @@ -64,7 +64,11 @@ jobs: cancel-in-progress: false # Fork PRs have no secrets. Skip cleanly rather than fail loudly on something # the contributor cannot fix — `tests.yml` still gives them a green signal. - if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }} + # Dependabot PRs skip for the same reason: they run under the Dependabot + # secret store (a distinct, narrower set), so a secret-consuming live suite + # can fail on a change Dependabot cannot fix. A dependency bump's real + # signal is `tests.yml` + the lockfile checks. + if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }} strategy: # A one-element matrix, not a cross-product: the Supabase adapter only ever diff --git a/.github/workflows/prisma-example-readme-e2e.yml b/.github/workflows/prisma-example-readme-e2e.yml index 15652254d..8f0de37d7 100644 --- a/.github/workflows/prisma-example-readme-e2e.yml +++ b/.github/workflows/prisma-example-readme-e2e.yml @@ -33,7 +33,10 @@ jobs: # Skip cleanly on fork PRs where secrets aren't available. The # test's `describe.skipIf(!authConfigured)` would also skip, but # gating at the job level produces a clean "skipped" status. - if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }} + # Dependabot PRs skip too — they run under the Dependabot secret store, so a + # secret-consuming live suite can fail on a change Dependabot cannot fix; + # `tests.yml` + lockfile checks are the real signal for a dependency bump. + if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }} env: CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }} diff --git a/.github/workflows/prisma-next-e2e.yml b/.github/workflows/prisma-next-e2e.yml index 8c2e260ae..073bc4987 100644 --- a/.github/workflows/prisma-next-e2e.yml +++ b/.github/workflows/prisma-next-e2e.yml @@ -34,8 +34,11 @@ jobs: # Skip cleanly on fork PRs where secrets aren't available. The # global-setup hook in the suite hard-errors when `CS_WORKSPACE_CRN` # is unset; gating at the job level produces a clean "skipped" - # status instead of a noisy failure. - if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }} + # status instead of a noisy failure. Dependabot PRs skip too — they run + # under the Dependabot secret store, so a secret-consuming live suite can + # fail on a change Dependabot cannot fix; `tests.yml` + lockfile checks are + # the real signal for a dependency bump. + if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }} env: CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }}