From 2c1e1d487c18a895bda017da2ac69c46e6dda359 Mon Sep 17 00:00:00 2001 From: Nick Josevski Date: Tue, 11 Aug 2026 22:01:42 +1000 Subject: [PATCH] ci: skip integration tests on Dependabot branches All three Dependabot PRs opened since #630 (#671, #672, #673) fail this workflow at "Initialize containers", and none of them fail for a reason related to the dependency being bumped. GitHub scopes secrets for Dependabot-triggered runs to a separate Dependabot secrets store, so DB_IMAGE_SA_PASSWORD, OD_IMAGE_ADMIN_API_KEY and OCTOPUS_SERVER_BASE64_LICENSE all resolve to empty. The log shows it unmasked, where a real secret would print as ***: -e "DB_CONNECTION_STRING=Server=sqlserver;...;User Id=sa;Password=;" SQL Server then rejects every login ("Login failed for user 'sa'. Reason: An error occurred while evaluating the password"), the health check never passes, the service container is marked unhealthy and the job dies before any test runs. Every dependabot/* branch fails; every human branch, main, release-please and the nightly schedule pass. Skipping is preferred over supplying the secrets. Copying them into the Dependabot store would hand an Octopus license and a test API key to a run whose dependency tree just changed and which executes third-party code via go test, and it still would not go green, because dorny/test-reporter needs checks: write and the Dependabot token stays read-only regardless of the permissions block. Coverage is retained: the nightly run on main picks up merged bumps within a day, and workflow_dispatch still works on a Dependabot branch since the triggering actor is then a human -- gh workflow run integration-test.yml --ref dependabot/go_modules/... Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/integration-test.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml index 1f5e64e0..018d6bf5 100644 --- a/.github/workflows/integration-test.yml +++ b/.github/workflows/integration-test.yml @@ -16,6 +16,13 @@ env: SERVER_URL: "http://localhost:8080" jobs: test: + # Dependabot-triggered runs cannot read Actions secrets -- GitHub scopes those + # to a separate Dependabot secrets store -- so SA_PASSWORD resolves to empty, + # SQL Server rejects every login, and the service container never turns + # healthy. Skip rather than fail red: the nightly run on main covers merged + # bumps, and `gh workflow run integration-test.yml --ref ` still works + # on a Dependabot branch, because the triggering actor is then a human. + if: github.actor != 'dependabot[bot]' runs-on: ubuntu-latest services: sqlserver: