Skip to content

fix(ci): skip Dependabot PRs in the generated workflow - #619

Merged
zeshi-du merged 2 commits into
TestSprite:mainfrom
Smile-Catpy:fix/ci-dependabot-secrets
Nov 9, 2026
Merged

fix(ci): skip Dependabot PRs in the generated workflow#619
zeshi-du merged 2 commits into
TestSprite:mainfrom
Smile-Catpy:fix/ci-dependabot-secrets

Conversation

@Smile-Catpy

@Smile-Catpy Smile-Catpy commented Oct 21, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

The generated workflow skips fork PRs because they run without repository secrets. Dependabot PRs have the same problem but pass that guard: Dependabot pushes its branches to the base repository, so head.repo.full_name == github.repository. GitHub Actions does not expose repository Actions secrets to Dependabot-triggered runs anyway — only Dependabot secrets — so ${{ secrets.TESTSPRITE_API_KEY }} is empty and the gate fails on every dependency PR.

Add github.actor != 'dependabot[bot]' to the pull_request branch of the generated if:, with a note next to the fork rule. The deployment_status branch is unchanged.

Related issue

Closes #508

Season 4 CLI Improvement Bonus

  • I'm entering this PR for the Season 4 CLI Improvement Bonus

Discord username: smilecat__

Type of change

  • Bug fix (non-breaking change that fixes an issue)

Checklist

  • PR targets the main branch.
  • Commits follow Conventional Commits.
  • npm run lint and npm run format:check pass.
  • npm run typecheck passes.
  • npm test passes and coverage stays at or above the 80% gate.
  • New behavior is covered by unit tests (mock-based; no network or credentials).
  • DOCUMENTATION.md reflects the generated workflow.

Notes for reviewers

  • The default snapshot and the timeout/self-hosted snapshot are updated; the only
    functional change is the added github.actor check in the pull_request branch.
  • The guard test asserts the new condition, so it fails on the pre-fix template.

Summary by CodeRabbit

  • Bug Fixes
    • Generated GitHub Actions workflows now skip Dependabot pull requests, in addition to forked and draft pull requests.
  • Documentation
    • Updated workflow documentation to list Dependabot pull requests among those skipped.

@Smile-Catpy
fix(ci): skip Dependabot PRs in the generated workflow
dc93fe4 
Dependabot branches live in the base repository, so the fork guard passes,
but Dependabot-triggered runs get Dependabot secrets, not Actions secrets.
The generated gate therefore ran every dependency PR with an empty
TESTSPRITE_API_KEY and failed permanently.

Add `github.actor != 'dependabot[bot]'` to the pull_request branch and note
it next to the fork rule; the deployment_status branch is unchanged.

Closes TestSprite#508
@coderabbitai

coderabbitai Bot commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Explain Change →

Caution

Review failed

The pull request is closed.

No actionable comments were generated in the recent review.

Walkthrough

The generated GitHub Actions workflow now excludes pull requests authored by dependabot[bot]. The workflow test and documentation reflect the actor check and explain that Dependabot does not receive repository Actions secrets.

Changes

Dependabot workflow guard

Layer / File(s) Summary
Add and document the Dependabot guard
src/commands/ci.ts, src/commands/ci.spec.ts, DOCUMENTATION.md		 The generated pull-request condition excludes dependabot[bot]. The test checks for this condition. The workflow comment and documentation describe the exclusion and Dependabot's lack of access to repository Actions secrets.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested labels: hackathon

Merge Risk: Low · up to 7f9e5

Documentation can mislead users about when Dependabot-related previews and tests run, and omits how to retain checks. Correcting it would prevent unexpected runs and missed checks.

Pre-merge checks: Passed 5

Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the main change: skipping Dependabot pull requests in the generated CI workflow.
Linked Issues check Passed Issue #508 requires the generated workflow to skip Dependabot pull requests because repository Actions secrets are unavailable. The PR adds github.actor != 'dependabot[bot]' to the pull_request co…
Out of Scope Changes check Passed The changed files support issue #508. The workflow template implements the guard, the test expectation verifies it, and the documentation and snapshots update generated workflow output. No unrelated f…
Docstring Coverage Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 …
Full details: Linked Issues check

Explanation

Issue #508 requires the generated workflow to skip Dependabot pull requests because repository Actions secrets are unavailable. The PR adds github.actor != 'dependabot[bot]' to the pull_request condition and leaves the deployment_status branch unchanged. The generated comment and DOCUMENTATION.md describe the Dependabot case. src/commands/ci.spec.ts checks the generated condition.

Full details: Out of Scope Changes check

Explanation

The changed files support issue #508. The workflow template implements the guard, the test expectation verifies it, and the documentation and snapshots update generated workflow output. No unrelated functional change is identified.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

ℹ️ Recent review info

⚙️ Run configuration

  • Configuration used: Repository: TestSprite/testsprite-cli/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 4629e426-f403-4d57-9b4d-d50e63889d53
📥 Commits

Reviewing files that changed from the base of the PR and between d61e6df and dc93fe4.

⛔ Files ignored due to path filters: 1

  • src/commands/__snapshots__/ci.spec.ts.snap is excluded by !**/*.snap, !**/*.snap
📒 Files selected for processing: 3

  • DOCUMENTATION.md
  • src/commands/ci.spec.ts
  • src/commands/ci.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 5 remain after this review.

@fyZhang66 fyZhang66 mentioned this pull request Oct 21, 2026
Closed
@github-actions

github-actions Bot commented Oct 22, 2026

Copy link
Copy Markdown

🏆 Season 4 CLI Improvement Bonus: entry recorded. Thanks, @Smile-Catpy!

To be counted, this PR needs the following by Oct 29, 11:59 PM PT:

  • ✅ A linked issue assigned to you.
  • ✅ Out of draft.
  • ✅ A Discord username in the description.

Rewards go to merged PRs judged a genuine improvement, and up to three bonus-eligible PRs count per person. Untick the box to withdraw the entry. This comment refreshes when you edit the PR. Full rules.

@github-actions github-actions Bot added the s4-cli-bonus Entered for the Season 4 CLI Improvement Bonus label Oct 22, 2026
This was referenced Oct 27, 2026
Open
Merged
@Smile-Catpy

Smile-Catpy commented Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

Friendly ping — the Season 4 window closes 2026-10-29 23:59 PT. This PR (plus #617 and #618) is ready for review: gate is green, the bonus entry is recorded, and it merges cleanly with current main. Happy to adjust anything before the deadline. Thanks!

@zeshi-du
zeshi-du merged commit e67235a into TestSprite:main Nov 9, 2026
25 of 26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zeshi-du zeshi-du zeshi-du approved these changes
@ruili-testsprite ruili-testsprite Awaiting requested review from ruili-testsprite ruili-testsprite is a code owner

Assignees

No one assigned

Labels

s4-cli-bonus Entered for the Season 4 CLI Improvement Bonus

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Hackathon] fix(ci): the ci init github workflow fails on every Dependabot PR (no Actions secrets), but only skips forks

2 participants

@Smile-Catpy @zeshi-du