From 61ee880a3be98f4c41104a8445f670a12553e6db Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 09:46:13 +0000 Subject: [PATCH] Exclude bot-authored PRs from Sonar/Codecov secret steps Co-Authored-By: Andreas Igel --- .github/workflows/maven.yml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 568078fd..9082f640 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -121,8 +121,11 @@ jobs: if-no-files-found: warn - name: SonarCloud Analysis - # Skip when SONAR_TOKEN is unavailable (fork/Dependabot PRs). - if: env.SONAR_TOKEN != '' + # Skip when SONAR_TOKEN is unavailable (fork PRs) and for any bot-authored + # PR (Dependabot, Renovate, ...). The bot check uses the PR author's + # account type rather than a hard-coded login, and is not defeated by a + # maintainer re-run (which would otherwise make the withheld token appear). + if: env.SONAR_TOKEN != '' && github.event.pull_request.user.type != 'Bot' run: mvn -B org.sonarsource.scanner.maven:sonar-maven-plugin:sonar --file pom.xml - name: Upload JaCoCo HTML report (processor) @@ -174,8 +177,8 @@ jobs: if-no-files-found: warn - name: Upload test results to Codecov (processor) - # Skip when CODECOV_TOKEN is unavailable (fork/Dependabot PRs). - if: always() && env.CODECOV_TOKEN != '' + # Skip when CODECOV_TOKEN is unavailable (fork PRs) and for any bot-authored PR. + if: always() && env.CODECOV_TOKEN != '' && github.event.pull_request.user.type != 'Bot' uses: codecov/test-results-action@47f89e9acb64b76debcd5ea40642d25a4adced9f # v1.1.1 with: token: ${{ secrets.CODECOV_TOKEN }} @@ -186,8 +189,8 @@ jobs: verbose: false - name: Upload coverage to Codecov (processor) - # Skip when CODECOV_TOKEN is unavailable (fork/Dependabot PRs). - if: always() && env.CODECOV_TOKEN != '' + # Skip when CODECOV_TOKEN is unavailable (fork PRs) and for any bot-authored PR. + if: always() && env.CODECOV_TOKEN != '' && github.event.pull_request.user.type != 'Bot' uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v5.0.7 with: fail_ci_if_error: true