From bd84f27a77165ab5ff240f0bcd40eba729c14663 Mon Sep 17 00:00:00 2001 From: Ned Wolpert Date: Sat, 13 Jun 2026 08:08:01 -0700 Subject: [PATCH] ci: skip SonarQube and Stryker on Dependabot PRs (secrets withheld) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub withholds repository secrets from Dependabot-triggered workflow runs, so the SonarQube scan (SONAR_TOKEN) and Stryker dashboard reporter (STRYKER_DASHBOARD_API_KEY) hard-fail on every Dependabot PR — the browser-mutation job went red on #64 and #65. The existing guard only excluded fork PRs, but Dependabot branches live in the same repo, so they slipped through. Exclude `github.actor == 'dependabot[bot]'` from both steps. The vitest suite still runs (so any future npm-dependency Dependabot PR is still gated on tests), and mutation-testing a dependency bump added no signal anyway. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9d0a9d9..edc6d7e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -81,9 +81,10 @@ jobs: - name: SonarQube scan # JavaScript/browser-SDK static analysis only. SonarQube was dropped for the JVM modules # (ADR 0018, native JaCoCo gates) but retained here for the TypeScript SDK. - # SONAR_TOKEN is unavailable to PRs from forks; skip there to avoid a hard failure. - # Manual (workflow_dispatch) and push runs always have the secret available. - if: github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository + # Needs SONAR_TOKEN, which GitHub withholds from fork PRs AND from Dependabot-triggered + # runs — skip in both cases so the scan doesn't hard-fail without a token. Manual + # (workflow_dispatch) and push runs always have the secret available. + if: github.actor != 'dependabot[bot]' && (github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) uses: sonarsource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} @@ -91,6 +92,10 @@ jobs: projectBaseDir: clients/passkeys-browser - name: Run Stryker mutation tests + # Skip on Dependabot PRs: the dashboard reporter needs STRYKER_DASHBOARD_API_KEY, which is + # withheld from Dependabot-triggered runs, and mutation testing a dependency bump adds no + # signal. The vitest suite above still runs and gates the PR. + if: github.actor != 'dependabot[bot]' run: npm exec --no-install -- stryker run working-directory: clients/passkeys-browser env: