Skip to content

Codex/skip dependabot integration tests - #52

Closed
soe-relewise wants to merge 2 commits into
mainfrom
codex/skip-dependabot-integration-tests
Closed

Codex/skip dependabot integration tests#52
soe-relewise wants to merge 2 commits into
mainfrom
codex/skip-dependabot-integration-tests

Conversation

@soe-relewise

@soe-relewise soe-relewise commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

https://trello.com/c/mohcRXYf/21181-skip-integration-tests-in-dependabot-builds-for-the-java-sdk

Summary

  • Mark tests inheriting from TestBase as integration tests because they require DATASET_ID and API_KEY.
  • Keep credential-independent tests in the unit-test path.
  • Run only tests outside the integration group for Dependabot-triggered builds.
  • Continue running the full test suite and test reporter for human-authored branches.
  • Upgrade actions/setup-java to v5.6.0 and dorny/test-reporter to v3.

Superseded Dependabot PRs

This PR includes the changes from #48 and #49, which were closed without merging:

Those Dependabot branches appeared to fail because the existing CI workflow ran credential-dependent integration tests. Dependabot-triggered workflows intentionally do not receive the repository's DATASET_ID and API_KEY, so the failures did not necessarily indicate incompatibilities in the upgraded actions.

The action upgrades were folded into this human-authored PR so they can be validated by the normal CI path, including the full integration suite with the existing repository secrets. This also avoids merging the CI fix first and then resolving overlapping workflow changes when applying the two dependency upgrades separately.

Security rationale

The integration credentials are a dataset ID and Master API key for real customer datasets. They are not made available to Dependabot. Dependabot builds still generate and compile the SDK and run all tests that do not require those credentials.

Validation

  • git diff --check passed.
  • All workflow action references were audited after the upgrades.
  • Maven was unavailable locally, so runtime validation is delegated to this human-authored GitHub Actions build.
  • No generated SDK code was changed.

@soe-relewise
soe-relewise requested a review from mzanoni August 3, 2026 11:13

@mzanoni mzanoni left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we allow dependabot to get the secrets instead of this workaround?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants