fix: ignore Dependabot issues and pull requests

README.md

@@ -1,3 +1,5 @@
+> **Note:** Dependabot issues and pull requests are no longer supported. See the [changes](#changes) section below for details.
+
 # Dependent Issues
 
 > A GitHub Action for marking issues as dependent on another
@@ -61,10 +63,16 @@ Here how it can look like in practice:
 
 - **GITHUB_TOKEN** (Required): The token to use to make API calls to GitHub.
 
+## Changes
+
+- **March 20, 2021:** To avoid unnecessary failure due to [insufficient permissions][dependabot-change] in Dependabot PRs, all Dependabot issues and pull requests are now ignored. This behavior is not configurable.
+
 ## Credits
 
 Special thanks to [Jason Etcovitch](https://github.com/JasonEtco) for the original bot idea.
 
 ## License
 
 MIT © [Ahmed T. Ali](https://github.com/z0al)
+
+[dependabot-change]: https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/

src/__tests__/support.test.ts

@@ -0,0 +1,21 @@
+import { isSupported } from '../support';
+
+describe('isSupported', () => {
+	it('should not fail when given incomplete issue data', () => {
+		const issue: any = {
+			user: null,
+		};
+
+		expect(isSupported(issue)).toEqual(true);
+	});
+
+	it('should return false for Dependabot issues or pull requests', () => {
+		const issue: any = {
+			user: {
+				login: 'dependabot[bot]',
+			},
+		};
+
+		expect(isSupported(issue)).toEqual(false);
+	});
+});

src/check.ts

@@ -3,6 +3,7 @@ import * as core from '@actions/core';
 
 // Ours
 import { ActionContext } from './types';
+import { isSupported } from './support';
 
 import {
 	IssueManager,
@@ -20,6 +21,13 @@ export async function checkIssues(context: ActionContext) {
 
 	for (const issue of context.issues) {
 		core.startGroup(`Checking #${issue.number}`);
+
+		if (!isSupported(issue)) {
+			core.info('Unsupported issue or pull request. Skipped');
+			core.endGroup();
+			continue;
+		}
+
 		let dependencies = extractor.fromIssue(issue);
 
 		if (dependencies.length === 0) {

src/support.ts

@@ -0,0 +1,16 @@
+// Ours
+import { Issue } from './types';
+
+/**
+ * Workflows triggered by Dependabot PRs will run with read-only
+ * permissions. We need to ignore them.
+ *
+ * https://bit.ly/2NDzjUM
+ */
+function isDependabotPR(issue: Issue) {
+	return issue.user?.login === 'dependabot[bot]';
+}
+
+export function isSupported(issue: Issue) {
+	return !isDependabotPR(issue);
+}