Skip to content

fix(ci): skip pull request automation without write credentials #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marandaneto merged 2 commits into from
Aug 24, 2026
Merged

fix(ci): skip pull request automation without write credentials #72

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
02ebe72
fix(ci): skip changeset hygiene without comment permissions
marandaneto Aug 24, 2026
90cfcab
fix(ci): skip project board updates without app credentials
marandaneto Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/changeset-hygiene.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@ permissions:

jobs:
check:
# Fork and Dependabot PR tokens are read-only, so they cannot upsert the report comment.
if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
name: Check changeset hygiene
runs-on: ubuntu-latest
timeout-minutes: 10
Expand Down
12 changes: 7 additions & 5 deletions .github/workflows/flags-project-board.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,11 +73,13 @@ jobs:
# the github.event_name is supposed to be `workflow_call`, but because this workflow lives in the special `.github` repository,
# it preserves the original event name (e.g. pull_request).
# This is a not well-documented special case.
# Dependabot-triggered runs execute in a restricted secret context with no
# access to PROJECT_BOARD_BOT_APP_ID / PRIVATE_KEY, so the token step below
# hard-fails because the client ID is empty on every dependency-bump
# PR. Skip them — dependency bumps don't belong on the feature flags board.
if: (github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request' || github.event_name == 'pull_request_review') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && github.actor != 'dependabot[bot]'
# Fork and Dependabot PRs run without the GitHub App credentials required below.
# On pull_request_review, github.actor is the reviewer, so inspect the PR author instead.
if: >-
github.event_name == 'workflow_dispatch' ||
((github.event_name == 'pull_request' || github.event_name == 'pull_request_review') &&
github.event.pull_request.head.repo.full_name == github.repository &&
github.event.pull_request.user.login != 'dependabot[bot]')
steps:
- name: Generate GitHub App Token
id: app-token
Expand Down