fix: skip review-app deploy for Dependabot PRs#234
Open
fsargent wants to merge 1 commit into
Open
Conversation
Dependabot PRs run with a separate secrets store and cannot read the FLY_API_TOKEN Actions secret, so the review-app deploy fails with 'no access token available'. Guard the job with github.actor != 'dependabot[bot]'. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Reviewer's guide (collapsed on small PRs)Reviewer's GuideAdds a conditional to the Fly review app GitHub Actions workflow so that the review_app job is skipped for Dependabot PRs, preventing failed deployments due to missing FLY_API_TOKEN in Dependabot’s separate secrets store. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/fly-review.yml" line_range="19-21" />
<code_context>
runs-on: ubuntu-latest
+ # Dependabot PRs run with a separate secrets store and cannot read
+ # FLY_API_TOKEN, so the review-app deploy fails. Skip them.
+ if: github.actor != 'dependabot[bot]'
outputs:
url: ${{ steps.deploy.outputs.url }}
</code_context>
<issue_to_address>
**suggestion:** Consider hardening the Dependabot detection to cover additional Dependabot identities and trigger types.
`github.actor != 'dependabot[bot]'` will miss a few cases:
- Legacy/preview Dependabot uses `dependabot-preview[bot]`.
- On `pull_request` events, `github.actor` may be a human retriggering a Dependabot PR, so checking the actor can be misleading.
For PRs, consider keying off `github.event.pull_request.user.login` and excluding both `dependabot[bot]` and `dependabot-preview[bot]`, e.g.:
```yaml
if: >-
github.event.pull_request.user.login != 'dependabot[bot]' &&
github.event.pull_request.user.login != 'dependabot-preview[bot]'
```
(or equivalent logic for your supported events).
```suggestion
# Dependabot PRs run with a separate secrets store and cannot read
# FLY_API_TOKEN, so the review-app deploy fails. Skip them.
# For PRs, key off the PR author; for other events, fall back to the actor.
if: >-
(github.event_name == 'pull_request' &&
github.event.pull_request.user.login != 'dependabot[bot]' &&
github.event.pull_request.user.login != 'dependabot-preview[bot]') ||
(github.event_name != 'pull_request' &&
github.actor != 'dependabot[bot]' &&
github.actor != 'dependabot-preview[bot]')
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+19
to
+21
| # Dependabot PRs run with a separate secrets store and cannot read | ||
| # FLY_API_TOKEN, so the review-app deploy fails. Skip them. | ||
| if: github.actor != 'dependabot[bot]' |
Contributor
There was a problem hiding this comment.
suggestion: Consider hardening the Dependabot detection to cover additional Dependabot identities and trigger types.
github.actor != 'dependabot[bot]' will miss a few cases:
- Legacy/preview Dependabot uses
dependabot-preview[bot]. - On
pull_requestevents,github.actormay be a human retriggering a Dependabot PR, so checking the actor can be misleading.
For PRs, consider keying off github.event.pull_request.user.login and excluding both dependabot[bot] and dependabot-preview[bot], e.g.:
if: >-
github.event.pull_request.user.login != 'dependabot[bot]' &&
github.event.pull_request.user.login != 'dependabot-preview[bot]'(or equivalent logic for your supported events).
Suggested change
| # Dependabot PRs run with a separate secrets store and cannot read | |
| # FLY_API_TOKEN, so the review-app deploy fails. Skip them. | |
| if: github.actor != 'dependabot[bot]' | |
| # Dependabot PRs run with a separate secrets store and cannot read | |
| # FLY_API_TOKEN, so the review-app deploy fails. Skip them. | |
| # For PRs, key off the PR author; for other events, fall back to the actor. | |
| if: >- | |
| (github.event_name == 'pull_request' && | |
| github.event.pull_request.user.login != 'dependabot[bot]' && | |
| github.event.pull_request.user.login != 'dependabot-preview[bot]') || | |
| (github.event_name != 'pull_request' && | |
| github.actor != 'dependabot[bot]' && | |
| github.actor != 'dependabot-preview[bot]') |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Dependabot PRs opened by #231 fail the Deploy Review App workflow with:
```
FLY_API_TOKEN:
Error: no access token available. Please login with 'flyctl auth login'
```
Dependabot PRs run against a separate secrets store and cannot read the `FLY_API_TOKEN` Actions secret, so it arrives empty. (Prod `fly.yml` deploys are unaffected — they were never broken; the deploy key never expired.)
Fix
Guard the `review_app` job with `if: github.actor != 'dependabot[bot]'` so Dependabot PRs skip the review-app deploy entirely. This avoids exposing an org-scoped Fly token to the Dependabot CI context (the more secure option vs. adding the token to the Dependabot secrets store).
Dependabot PRs still run the normal Django test workflow; they just don't spin up an ephemeral preview app.
🤖 Generated with Claude Code
Summary by Sourcery
CI: