From c8fe40085d9ef4d5371c1ec09275b85a160092b7 Mon Sep 17 00:00:00 2001 From: James Newman Date: Wed, 29 Jul 2026 15:51:11 -0400 Subject: [PATCH] ci: guard pr-notify against Dependabot runs explicitly Dependabot-triggered runs resolve secrets against a separate, repository-scoped store that GCHAT_PRS_WEBHOOK is not in, so the notifier would fail with "Input required and not supplied: webhookUrl". That does not happen today, but only incidentally: pr-notify needs security-checks, the shared security-checks workflow already guards on this same condition, and a skipped dependency skips this job. Adding always() to pr-notify, or dropping security-checks from its needs, would silently turn every Dependabot PR red. github.actor is what determines which secrets store a run reads from, so a human pushing to a Dependabot branch is unaffected. No behaviour change - this makes the existing protection intentional and local. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/pull-request.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 95135f56a..1477319b4 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -196,7 +196,8 @@ jobs: pr-notify: if: > github.event_name == 'pull_request' && - github.event.pull_request.draft == false + github.event.pull_request.draft == false && + github.actor != 'dependabot[bot]' needs: - instrumented-core - instrumented-kit-base