From 9763935c2934cf7df7489abc0ff93f9320a11add Mon Sep 17 00:00:00 2001 From: deacon-mp Date: Thu, 23 Jul 2026 15:51:32 -0400 Subject: [PATCH] ci: skip SonarQube scan on Dependabot PR runs Dependabot-authored pull_request runs receive no repository secrets, so SONAR_TOKEN is empty and the scan step can only fail (exit 3, 'Not authorized'), turning every Dependabot PR red regardless of test results. This began when the repository transfer dropped the Dependabot-scope secret; the Actions-scope secret still works, so pushes and human PRs are unaffected. Skip the scan for Dependabot runs; the merged result is still analyzed by the push-event run on master, and fork PRs already route through the trusted sonar-fork-pr.yml path. --- .github/workflows/quality.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 80c4cafdc..d88c31a01 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -59,7 +59,10 @@ jobs: run: tox - name: SonarQube Scan - if: ${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) }} + # Dependabot-authored PR runs receive no repository secrets, so SONAR_TOKEN is + # empty and the scan can only fail; skip it there. The merged result is still + # scanned by the push-event run on master. + if: ${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && github.actor != 'dependabot[bot]') }} uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}