From 89d62c424b1c02d9067b6caeeabf60ebe04f95a7 Mon Sep 17 00:00:00 2001 From: Raymond Khalife Date: Mon, 27 Jul 2026 15:08:53 +0000 Subject: [PATCH 1/2] infra: give Dependabot PRs a working build check Dependabot-triggered pull_request runs get a read-only GITHUB_TOKEN and no access to repo secrets, so preview-deployment.yml fails on its first step (posting the preview comment) with "Resource not accessible by integration". build.yml only ran for forks, so Dependabot branches (which live in this repo) skipped it and had no working check at all: every Dependabot PR showed red regardless of content. Route Dependabot PRs to build.yml alongside forks, and skip both preview-deployment.yml and pr-cleanup.yml for them since no preview canister is ever allocated. --- .github/workflows/build.yml | 8 ++++++-- .github/workflows/pr-cleanup.yml | 7 +++++-- .github/workflows/preview-deployment.yml | 8 ++++++-- 3 files changed, 17 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 008c8307..e78de370 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,8 +5,12 @@ on: jobs: build: - # only run in forks — non-fork PRs get a build via preview-deployment.yml - if: github.event.pull_request.head.repo.full_name != github.repository + # Runs wherever preview-deployment.yml cannot. Fork PRs and Dependabot PRs + # both get a read-only GITHUB_TOKEN with no access to secrets, so the + # preview deploy fails on them; this plain build is their only check. + if: >- + github.event.pull_request.head.repo.full_name != github.repository || + github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest permissions: contents: read diff --git a/.github/workflows/pr-cleanup.yml b/.github/workflows/pr-cleanup.yml index 64b19f97..2c5c339f 100644 --- a/.github/workflows/pr-cleanup.yml +++ b/.github/workflows/pr-cleanup.yml @@ -5,8 +5,11 @@ on: jobs: release_preview_canister: - # do not run in forks - if: github.event.pull_request.head.repo.full_name == github.repository + # Mirror preview-deployment.yml: only PRs that got a preview canister have + # one to release. Fork and Dependabot PRs never allocate one. + if: >- + github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.user.login != 'dependabot[bot]' runs-on: ubuntu-latest concurrency: group: pr-${{ github.event.pull_request.number || github.event.number }} diff --git a/.github/workflows/preview-deployment.yml b/.github/workflows/preview-deployment.yml index 0247506e..32959001 100644 --- a/.github/workflows/preview-deployment.yml +++ b/.github/workflows/preview-deployment.yml @@ -5,8 +5,12 @@ on: jobs: build_and_deploy: - # do not run in forks - if: github.event.pull_request.head.repo.full_name == github.repository + # Needs repo secrets and write access to post the preview comment, so skip + # any PR whose runs get a read-only token: forks and Dependabot. Those are + # covered by build.yml instead. + if: >- + github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.user.login != 'dependabot[bot]' runs-on: ubuntu-latest concurrency: group: pr-${{ github.event.pull_request.number || github.event.number }} From ebfeec0110cce850a42e5e74c776dc4f744f7f87 Mon Sep 17 00:00:00 2001 From: Marco Walz Date: Tue, 4 Aug 2026 11:11:03 +0200 Subject: [PATCH 2/2] infra: initialize the motoko submodule in the build check build.yml only initialized .sources/examples, but 7 pages under docs/languages/motoko/ pull their code samples from .sources/motoko via `file=/...` includes. Without the submodule those pages render as a title with an empty body and the build still exits 0, so the check reports green on a site that is missing content. This matters now that Dependabot PRs rely on this workflow as their only check: they bump astro, @astrojs/starlight and vite, which are exactly the packages that can break markdown rendering. --- .github/workflows/build.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e78de370..83a5edc4 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -17,10 +17,14 @@ jobs: steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - name: Initialize examples submodule + # Same set as preview-deployment.yml. .sources/motoko is required: pages + # under docs/languages/motoko/ pull code via `file=/...` + # includes, and without the submodule they render empty without failing + # the build. + - name: Initialize submodules run: | git config --global url."https://github.com/".insteadOf "git@github.com:" - git submodule update --init --depth 1 .sources/examples + git submodule update --init --depth 1 .sources/examples .sources/motoko - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: