From 61b3f29bc56bb622e3c4c2a0d799b0b719946364 Mon Sep 17 00:00:00 2001 From: Austin McKinley Date: Fri, 24 Jul 2026 18:36:54 -0700 Subject: [PATCH] ci: skip the per-PR OTA job for bot authors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot pushes in-repo branches, so its PRs pass the fork guard and the per-PR OTA job runs — but GitHub withholds repo secrets from Dependabot- triggered runs, so EXPO_TOKEN is empty and the job fails at "Setup Expo project". Result: a red check on every dependabot PR (fails closed, nothing reaches AWS, but it's noise on an unrelated PR). Exclude bot authors via user.type. This keeps the fork guard as the trust boundary and does not reintroduce the author_association check, which wrongly skipped private org members' PRs. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/pull-request-commit.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pull-request-commit.yml b/.github/workflows/pull-request-commit.yml index 133e7ede46..d800e2be73 100644 --- a/.github/workflows/pull-request-commit.yml +++ b/.github/workflows/pull-request-commit.yml @@ -234,12 +234,19 @@ jobs: # This matches the fork-guard gate the other jobs in this workflow use; # author_association is deliberately NOT checked (it can't identify a private # org member and would skip their PRs). + # + # Bot authors are excluded: Dependabot pushes in-repo branches, so it passes + # the fork guard, but GitHub withholds repo secrets from Dependabot-triggered + # runs. EXPO_TOKEN is then empty and the job fails at setup — a red check on + # every dependabot PR. There is no OTA preview worth publishing for a + # dependency bump anyway. publish-pr-ota: name: Publish PR OTA to denis runs-on: ubuntu-latest if: >- github.event_name == 'pull_request' && - github.event.pull_request.head.repo.full_name == github.repository + github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.user.type != 'Bot' concurrency: group: pr-ota-${{ github.event.pull_request.number }} cancel-in-progress: true