fix: Skip Netlify deployment for Dependabot PRs #660
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Dependabot PRs cannot access repository secrets due to GitHub's security model. This causes the Netlify preview deployment to fail with 'Unauthorized' errors. Changes: - Add conditional check to skip Netlify deploy when actor is dependabot[bot] - Also skip for PRs from forks or when secrets are unavailable - Add informative skip message step for transparency - Only post PR comment when deployment actually succeeds - Move secrets to job-level env for proper conditional access This ensures: - Dependabot PRs pass CI without Netlify preview (acceptable trade-off) - Regular contributor PRs continue to get Netlify previews - No security risks from exposing secrets to untrusted actors - Clear logging when deployment is skipped Fixes the issue reported in PR #659
|
📖 Netlify Preview Ready! Preview URL: https://pr-660--sunny-cactus-210e3e.netlify.app (e7a2c65) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
PR #659 (and other Dependabot PRs) fail during the Netlify preview deployment step with:
Root Cause: GitHub's security model intentionally blocks repository secrets (
NETLIFY_AUTH_TOKEN,NETLIFY_SITE_ID) from being accessible to Dependabot-triggered workflows. This prevents malicious dependency updates from exfiltrating secrets.Solution
This PR adds conditional logic to gracefully skip Netlify deployment when:
dependabot[bot]Changes
ifcondition to Netlify deploy step checking for trusted actors and secret availabilityenvfor proper conditional accessOutcome
After merging:
Testing
Once merged, re-run PR #659 or any other Dependabot PR to verify:
Fixes #659