ci: graceful-skip ggshield + codecov when their secrets aren't set#28
Conversation
Newly-init'd modules from this template fail their first push because the optional GITGUARDIAN_API_KEY (ggshield) and CODECOV_TOKEN (codecov upload) secrets aren't configured yet. This adds `secrets.<NAME> != ''` gates so those steps no-op cleanly until the user wires the secrets up, instead of failing the workflow run. The ggshield gate also subsumes the existing Dependabot check (Dependabot PRs don't have secret access, so the secret-presence check skips them naturally) — but the explicit actor check is kept for self-documentation. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Updates GitHub Actions workflows to gracefully skip optional secret–dependent steps when their corresponding repository secrets are not configured, reducing failures/noise for newly initialized repos created from this template.
Changes:
- Gate the
ggshieldjob onsecrets.GITGUARDIAN_API_KEY != ''(in addition to the existing Dependabot actor check). - Gate the Codecov upload step in
CI.yamlonsecrets.CODECOV_TOKEN != ''.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/ggshield.yaml | Adds a secret-presence gate so the GitGuardian scan job is skipped when the API key isn’t configured. |
| .github/workflows/CI.yaml | Adds a secret-presence gate so the Codecov upload step is skipped when no token is configured. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The `secrets` context isn't available in `if:` expressions at any level (GitHub Actions context-availability rules), which is why the previous attempt to use `secrets.X != ''` directly in `if:` failed workflow validation. Standard workaround: declare the secret as a job-level (or step-level) `env:` value, then check `env.X != ''` in the `if:`. ggshield.yaml: secret moved to job-level env, gate is now `env.X != ''` on each step. Step-level env on the action invocation is no longer needed (job-level env is inherited). CI.yaml codecov: secret declared as step-level env, gate is appended to the existing condition. token: also reads from env for consistency. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Summary
Adds
secrets.<NAME> != ''gates to two optional-secret workflow steps so newly-init'd modules from this template don't fail their first push:ggshield.yaml— extends the existing job-levelif:withsecrets.GITGUARDIAN_API_KEY != ''. The Dependabot actor check is kept for self-documentation, but is redundant under the new gate (Dependabot PRs have no access to repo secrets, so the secret-presence check naturally skips them).CI.yamlcodecov upload step — appendssecrets.CODECOV_TOKEN != ''to the existing condition. Thefail_ci_if_error: falseon the codecov action stays — it still protects against transient upload failures when the token is set.Why
This is item #3 of the post-PR-#18 follow-up scope (the original PR #18 description called this out as "Future improvements (out of scope)"). Currently:
GITGUARDIAN_API_KEYconfigured fails ggshield on every push with "Invalid GitGuardian API key".CODECOV_TOKENruns the codecov action, which then warns and produces no useful upload (it doesn't fail CI thanks tofail_ci_if_error: false, but it's noise).After this change, both steps short-circuit cleanly until the user wires the secrets up.
Validation strategy
This template repo has
GITGUARDIAN_API_KEYconfigured but notCODECOV_TOKEN, so on this PR's CI the GitGuardian gate evaluates to true and runs the scan (happy-path branch) while the codecov gate evaluates to false and skips the upload step (missing-secret branch) — both branches of the gate semantics are exercised end-to-end on this very PR.Test plan
PSScriptAnalyzer LintpassesUnit Tests (ubuntu/windows/macOS-latest)all passGitGuardian Scanruns (gate evaluates to true here, secret is set)CODECOV_TOKENis not set)Follow-up
After this lands, propagate to the 8 consumer repos that have these workflow files. Tracked in
project_psmoduletemplate_post_18_followups.md.🤖 Generated with Claude Code