ci: skip SonarQube scan on Dependabot PR runs - #3403
Merged
Conversation
Dependabot-authored pull_request runs receive no repository secrets, so SONAR_TOKEN is empty and the scan step can only fail (exit 3, 'Not authorized'), turning every Dependabot PR red regardless of test results. This began when the repository transfer dropped the Dependabot-scope secret; the Actions-scope secret still works, so pushes and human PRs are unaffected. Skip the scan for Dependabot runs; the merged result is still analyzed by the push-event run on master, and fork PRs already route through the trusted sonar-fork-pr.yml path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Gates the
SonarQube Scanstep in Code Quality so it is skipped on Dependabot-authored PR runs, where it can only fail.Problem
Every Dependabot PR now fails all four
build (3.x, ...style,coverage-ci)legs at the SonarQube step withNot authorized/ exit 3 — see #3402, where the test phase itself passed 562/562 on all four Python versions. The action's log showsSONAR_TOKEN:empty.Root cause: GitHub supplies Dependabot-triggered workflow runs with secrets from the separate Dependabot secrets store, not the Actions store. That secret did not survive the repository transfer — Dependabot PR #3399 passed these same legs on 2026-07-08 with an unchanged workflow, and #3402 fails them today. The Actions-scope
SONAR_TOKENstill works, so pushes and human PRs are unaffected.Fix
Add
github.actor != 'dependabot[bot]'to the step's existing condition. Chosen over alternatives:env.SONAR_TOKEN != '') would require lifting the secret to job-level env, widening the exposure that security(ci): fix SONAR_TOKEN exfiltration in sonar_fork_pr (pull_request_target + fork-controlled scanner config) #3376 deliberately narrowed to step scope.sonar-fork-pr.ymlpath doesn't work — it hard-gates onhead_repository.fork == trueand Dependabot branches live in this repo.Coverage is not lost: the merged result is still analyzed by the push-event run on master.
Follow-up (out of scope)
Restoring analysis parity for Dependabot PRs requires adding
SONAR_TOKENto this repo's Dependabot secrets (admin / Infra). If that is done, this guard clause can be reverted.sonar-project.propertiesalso still binds to the pre-transfermitreSonarCloud organization, which maintainers may want to revisit.