From 861c8952840e2b6840aa9e0eacb4e017a7990dec Mon Sep 17 00:00:00 2001 From: Amrit Krishnan Date: Sun, 16 Aug 2026 01:15:12 -0400 Subject: [PATCH] Skip docker build/push job for dependabot PRs Dependabot-triggered workflow runs never receive repository secrets (GitHub withholds them by design), so the GCP Workload Identity auth step always fails on dependabot PRs, showing a false CI failure on every dependency-bump PR that touches uv.lock. Skip the job in that case; the real build/push still runs on merge to main and on release. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/docker.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index b499fc9b..8ede3e33 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -31,6 +31,11 @@ permissions: jobs: push_to_registry: name: Build and push Docker images + # Dependabot PRs never receive repository secrets (GitHub withholds them + # from dependabot-triggered runs), so GCP auth always fails here. Skip + # the job for those PRs instead of reporting a false CI failure; the + # real image build/push still runs on merge to main and on release. + if: github.event_name != 'pull_request' || github.actor != 'dependabot[bot]' runs-on: - ubuntu-latest strategy: