From 6f27e6fc4e0b685ec5aec8df5b4caef6165875b9 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 22 Oct 2026 18:14:58 +0000
Subject: [PATCH] ci: skip PR runs triggered by igel-devin-ai

PRs opened by igel-devin-ai auto-start CI because the account is a
merged contributor and exempt from the external-contributor approval
gate. Skip the Java CI build and CodeQL analyze jobs for pull_request
runs sent by that actor (neutral 'skipped', not failed); pushes on the
same PRs are sent by devin-ai-integration[bot] and still wait for
maintainer approval, and a maintainer 'Re-run jobs' re-executes the
jobs under their own actor. The guard is scoped to pull_request so
schedule/push runs can never be attributed to the account.

fork-sonar and fork-coverage get the same check on the source run's
actor: a skipped CI run concludes 'success' and would otherwise fire
them only to fail on the missing artifacts.
---
 .github/workflows/codeql.yml        | 6 ++++++
 .github/workflows/fork-coverage.yml | 7 +++++--
 .github/workflows/fork-sonar.yml    | 5 ++++-
 .github/workflows/maven.yml         | 8 ++++++++
 4 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0c04894b..0c789e80 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,6 +28,12 @@ concurrency:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
+    # Same gate as the Java CI build job: PR runs sent by igel-devin-ai (Devin)
+    # are skipped; pushes by devin-ai-integration[bot] wait for maintainer
+    # approval, and a maintainer re-run passes the check. Scoped to pull_request
+    # so scheduled runs (whose actor is the workflow's last modifier) are not
+    # skipped.
+    if: github.event_name != 'pull_request' || github.actor != 'igel-devin-ai'
     # Runner size impacts CodeQL analysis time. To learn more, please see:
     #   - https://gh.io/recommended-hardware-resources-for-running-codeql
     #   - https://gh.io/supported-runners-and-hardware-resources
diff --git a/.github/workflows/fork-coverage.yml b/.github/workflows/fork-coverage.yml
index d479a6b8..bd7c5cf9 100644
--- a/.github/workflows/fork-coverage.yml
+++ b/.github/workflows/fork-coverage.yml
@@ -20,10 +20,13 @@ permissions:
 jobs:
   codecov:
     # Only for PRs that originate from a fork (same-repo PRs upload directly in
-    # the main CI workflow, which has secrets).
+    # the main CI workflow, which has secrets). Skipped for PR runs sent by
+    # igel-devin-ai (Devin): those are skipped in the CI build itself, so no
+    # coverage artifact exists to download.
     if: >
       github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name
+      github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name &&
+      github.event.workflow_run.actor.login != 'igel-devin-ai'
     runs-on: ubuntu-latest
     env:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/fork-sonar.yml b/.github/workflows/fork-sonar.yml
index e930fd15..5aeaaaa9 100644
--- a/.github/workflows/fork-sonar.yml
+++ b/.github/workflows/fork-sonar.yml
@@ -34,10 +34,13 @@ concurrency:
 
 jobs:
   sonar:
+    # Skipped for PR runs sent by igel-devin-ai (Devin): the CI build itself is
+    # skipped for that actor, so no analysis-inputs artifact exists to download.
     if: >
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name
+      github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name &&
+      github.event.workflow_run.actor.login != 'igel-devin-ai'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     environment: fork-ci
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index e2f605cd..103072b9 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -23,6 +23,14 @@ concurrency:
 
 jobs:
   build:
+    # PR runs sent by igel-devin-ai (Devin: `opened`/`reopened` events) are
+    # skipped as neutral instead of consuming CI - later pushes are sent by
+    # devin-ai-integration[bot] and already wait for maintainer approval. A
+    # maintainer "Re-run jobs" sets github.actor to themselves, so the job then
+    # executes normally. Scoped to pull_request events only: on `schedule`
+    # events github.actor is the workflow file's last modifier, which may be
+    # igel-devin-ai itself and would wrongly skip those runs.
+    if: github.event_name != 'pull_request' || github.actor != 'igel-devin-ai'
 
     runs-on: ubuntu-latest
     timeout-minutes: 20