From 89d62c424b1c02d9067b6caeeabf60ebe04f95a7 Mon Sep 17 00:00:00 2001
From: Raymond Khalife <raymond.khalife@dfinity.org>
Date: Mon, 27 Jul 2026 15:08:53 +0000
Subject: [PATCH] infra: give Dependabot PRs a working build check

Dependabot-triggered pull_request runs get a read-only GITHUB_TOKEN and no
access to repo secrets, so preview-deployment.yml fails on its first step
(posting the preview comment) with "Resource not accessible by integration".
build.yml only ran for forks, so Dependabot branches (which live in this repo)
skipped it and had no working check at all: every Dependabot PR showed red
regardless of content.

Route Dependabot PRs to build.yml alongside forks, and skip both
preview-deployment.yml and pr-cleanup.yml for them since no preview canister
is ever allocated.
---
 .github/workflows/build.yml              | 8 ++++++--
 .github/workflows/pr-cleanup.yml         | 7 +++++--
 .github/workflows/preview-deployment.yml | 8 ++++++--
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 008c8307..e78de370 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,8 +5,12 @@ on:
 
 jobs:
   build:
-    # only run in forks — non-fork PRs get a build via preview-deployment.yml
-    if: github.event.pull_request.head.repo.full_name != github.repository
+    # Runs wherever preview-deployment.yml cannot. Fork PRs and Dependabot PRs
+    # both get a read-only GITHUB_TOKEN with no access to secrets, so the
+    # preview deploy fails on them; this plain build is their only check.
+    if: >-
+      github.event.pull_request.head.repo.full_name != github.repository ||
+      github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/pr-cleanup.yml b/.github/workflows/pr-cleanup.yml
index 64b19f97..2c5c339f 100644
--- a/.github/workflows/pr-cleanup.yml
+++ b/.github/workflows/pr-cleanup.yml
@@ -5,8 +5,11 @@ on:
 
 jobs:
   release_preview_canister:
-    # do not run in forks
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Mirror preview-deployment.yml: only PRs that got a preview canister have
+    # one to release. Fork and Dependabot PRs never allocate one.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     concurrency:
       group: pr-${{ github.event.pull_request.number || github.event.number }}
diff --git a/.github/workflows/preview-deployment.yml b/.github/workflows/preview-deployment.yml
index 0247506e..32959001 100644
--- a/.github/workflows/preview-deployment.yml
+++ b/.github/workflows/preview-deployment.yml
@@ -5,8 +5,12 @@ on:
 
 jobs:
   build_and_deploy:
-    # do not run in forks
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Needs repo secrets and write access to post the preview comment, so skip
+    # any PR whose runs get a read-only token: forks and Dependabot. Those are
+    # covered by build.yml instead.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     concurrency:
       group: pr-${{ github.event.pull_request.number || github.event.number }}