From c8b31b3f57c3a0a1de3ff26c7b7334ed15c2e157 Mon Sep 17 00:00:00 2001
From: Maurice <mauriceboe@icloud.com>
Date: Thu, 8 Oct 2026 13:39:45 +0200
Subject: [PATCH] ci: skip the secret-dependent jobs on Dependabot runs

A run Dependabot triggers only sees Dependabot secrets, and its PRs come
from a branch in this repo, so the fork guard let s3-contract start with an
empty MINIO_LICENSE_KEY. AIStor then never became healthy and ci-ok went red
on every grouped bump PR. s3-contract and scan now also skip when Dependabot
is the actor; ci-ok already counts a skip as passed.
---
 .github/dependabot.yml     |  3 ++-
 .github/workflows/test.yml | 28 ++++++++++++++++++----------
 2 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 05787405d..47d23772a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,7 +7,8 @@
 # enforce-target-branch.yml moves those onto dev.
 #
 # Every PR runs test.yml like any other, so ci-ok decides whether it can
-# merge.
+# merge. Dependabot runs get no Actions secrets, so s3-contract and the Sonar
+# scan skip themselves on these PRs and ci-ok counts the skip as passed.
 version: 2
 updates:
   # The root lockfile covers the client, server and shared workspaces.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ab1195c95..15ffe5efb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,10 +25,11 @@ permissions:
 #     must stop the scan — a missing lcov file would make every line of that
 #     package report as uncovered, and the dashboard would show a collapse
 #     that did not happen. (The preflight gates stop it transitively.)
-#   - Fork PRs don't receive secrets, so the two jobs that need them skip
-#     themselves: s3-contract (MINIO_LICENSE_KEY) and scan (SONAR_TOKEN).
-#     Everything else runs on fork PRs so outside contributors still get the
-#     full test signal.
+#   - Fork PRs and runs Dependabot triggers don't receive the repo's Actions
+#     secrets, so the two jobs that need them skip themselves: s3-contract
+#     (MINIO_LICENSE_KEY) and scan (SONAR_TOKEN). ci-ok counts a skip as
+#     passed. Everything else runs on those PRs so outside contributors and
+#     dependency bumps still get the full test signal.
 #   - changes runs first and decides which of the jobs below a change needs
 #     (scripts/ci/changed-areas.mjs holds the rules). A docs-only push or PR
 #     runs nothing else. The filter lives in a job, not in `on.paths`, because
@@ -449,10 +450,14 @@ jobs:
     timeout-minutes: 45
     needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
     # Fork PRs don't get repo secrets, so MINIO_LICENSE_KEY would be empty and
-    # the AIStor container would fail to boot. Pushes and manual dispatches do
-    # have secrets, so only fork PRs are filtered out. (The implicit success()
-    # on this expression also keeps the job skipped when a preflight fails.)
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    # the AIStor container would fail to boot. A run Dependabot triggers gets
+    # only Dependabot secrets, so its PRs (same repo, not a fork) hit the same
+    # wall. Pushes and manual dispatches by anyone else do have secrets, so
+    # only those two are filtered out. (The implicit success() on this
+    # expression also keeps the job skipped when a preflight fails.)
+    if: >-
+      github.actor != 'dependabot[bot]' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
 
     steps:
       - uses: actions/checkout@v6
@@ -653,8 +658,11 @@ jobs:
     name: Scan
     runs-on: ubuntu-24.04
     timeout-minutes: 45
-    # Fork PRs don't receive SONAR_TOKEN — skip the scan rather than fail it.
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    # Fork PRs and Dependabot runs don't receive SONAR_TOKEN, so skip the scan
+    # rather than fail it.
+    if: >-
+      github.actor != 'dependabot[bot]' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     # Coverage jobs failing must stop the scan: a missing lcov file would make
     # every line of that package report as uncovered, and the dashboard would
     # show a collapse that did not happen. The preflight gates already stop it