From 95070a94bd4f272c8c386117e9b659d4093d652b Mon Sep 17 00:00:00 2001 From: Preetam Dwivedi Date: Wed, 14 Oct 2026 10:13:51 -0700 Subject: [PATCH] ci: skip live GitHub tests on Dependabot runs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary ### Why? Dependabot-triggered workflows only receive Dependabot secrets, so `SQ_TEST_REPO_TOKEN` is empty. The same-repo check still set `SQ_GITHUB_TEST_REQUIRED=true`, failing the merger and e2e jobs on every Dependabot PR (e.g. #853). ### What? - Treat `github.actor == 'dependabot[bot]'` like a fork PR: the live GitHub tests skip instead of failing. ## Test Plan - ✅ Workflow YAML parses; `githubtestrepo.New` skips when the token is empty and the required flag is false. - Post-merge: `@dependabot rebase` on #853 and confirm the Merger Extension Test passes (skipped live cases). --- .github/workflows/ci.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6c752d9b2..8b31def04 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -143,8 +143,9 @@ jobs: SQ_GITHUB_TEST_REPO: ${{ vars.SQ_GITHUB_TEST_REPO }} # Fail rather than skip when the secret is missing, but only in a # repository that set up a test repo (forks without one skip), and - # not on fork PRs, which GitHub never gives secrets to. - SQ_GITHUB_TEST_REQUIRED: ${{ vars.SQ_GITHUB_TEST_REPO != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} + # not on fork PRs or Dependabot runs, which GitHub never gives + # repository secrets to. + SQ_GITHUB_TEST_REQUIRED: ${{ vars.SQ_GITHUB_TEST_REPO != '' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} run: make e2e-test - name: Upload Bazel failure logs @@ -258,8 +259,9 @@ jobs: SQ_GITHUB_TEST_REPO: ${{ vars.SQ_GITHUB_TEST_REPO }} # Fail rather than skip when the secret is missing, but only in a # repository that set up a test repo (forks without one skip), and - # not on fork PRs, which GitHub never gives secrets to. - SQ_GITHUB_TEST_REQUIRED: ${{ vars.SQ_GITHUB_TEST_REPO != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} + # not on fork PRs or Dependabot runs, which GitHub never gives + # repository secrets to. + SQ_GITHUB_TEST_REQUIRED: ${{ vars.SQ_GITHUB_TEST_REPO != '' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} run: make integration-test-runway-merger - name: Upload Bazel failure logs