infra: give Dependabot PRs a working build check - #330
Open
raymondk wants to merge 1 commit into
Open
Conversation
Dependabot-triggered pull_request runs get a read-only GITHUB_TOKEN and no access to repo secrets, so preview-deployment.yml fails on its first step (posting the preview comment) with "Resource not accessible by integration". build.yml only ran for forks, so Dependabot branches (which live in this repo) skipped it and had no working check at all: every Dependabot PR showed red regardless of content. Route Dependabot PRs to build.yml alongside forks, and skip both preview-deployment.yml and pr-cleanup.yml for them since no preview canister is ever allocated.
|
🤖 Here's your preview: https://z4vwg-raaaa-aaaam-aiiga-cai.icp0.io |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every
chore(deps)PR in this repo currently shows a red X, and none of them are actually broken by their dependency bump.Dependabot-triggered
pull_requestruns get a read-onlyGITHUB_TOKENand no access to repo secrets.preview-deployment.ymldies on its very first step (posting the "🤖 Your PR preview is being built..." comment) withHttpError: Resource not accessible by integration, and would fail again later onsecrets.POOL_CONTROLLER_IDENTITY.Meanwhile
build.ymlonly ran for forks (head.repo.full_name != github.repository). Dependabot branches live in this repo, so they skipped it. Net result: Dependabot PRs had no working build check at all.Changes
build.ymlalso runs for Dependabot PRs, so they get a realnpm run buildcheck.preview-deployment.ymlskips Dependabot PRs (cannot succeed there).pr-cleanup.ymlskips Dependabot PRs, mirroring the above: no preview canister is ever allocated, so there is nothing to release.All three use
github.event.pull_request.user.loginrather thangithub.actorso the behaviour stays consistent for the whole life of a PR, not just the Dependabot-actored events.Verified
if:expressions fold to the intended single-line form.npm run buildpasses on this branch (209 pages).