From 5612055db11368217efd9dbf39725a55eb010f51 Mon Sep 17 00:00:00 2001 From: Amrit Krishnan Date: Sun, 16 Aug 2026 08:48:12 -0400 Subject: [PATCH] Skip Codecov upload for dependabot PRs Dependabot-triggered workflow runs never receive repository secrets, so CODECOV_TOKEN is empty and the upload step fails with "Token required because branch is protected" (fail_ci_if_error: true), taking down the whole unit-tests job even though pytest itself passed. Same root cause and fix pattern as the docker job in #304. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/unit_tests.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml index 164e0747..e4e989c9 100644 --- a/.github/workflows/unit_tests.yml +++ b/.github/workflows/unit_tests.yml @@ -82,10 +82,17 @@ jobs: uv run --frozen pytest tests/test_imports.py - name: Import Codecov GPG public key + if: github.actor != 'dependabot[bot]' run: | gpg --keyserver keyserver.ubuntu.com --recv-keys 806BB28AED779869 + # Dependabot PRs never receive repository secrets (GitHub withholds + # them from dependabot-triggered runs), so CODECOV_TOKEN is empty and + # this step fails with "Token required because branch is protected", + # taking down the whole job even though the tests above passed. Skip + # the upload in that case. - name: Upload coverage to Codecov + if: github.actor != 'dependabot[bot]' uses: codecov/codecov-action@v7.0.0 with: token: ${{ secrets.CODECOV_TOKEN }}