Repository navigation
Do not fail CI when a token is unavailable - #122
Conversation
Dependabot pull requests run without repository secrets, so CODACY_PROJECT_TOKEN and SONAR_TOKEN are empty on them. The coverage upload and the SonarCloud scan then fail, and the pull request shows red although the tests passed on every platform. #114 has been sitting in that state since yesterday. Uploading coverage is best-effort, as it already is in gosn-v2, so it now continues on error. The scan cannot run at all without its token, so it is skipped when the token is absent rather than failing. The token moves to job level so the step's condition can see it. Neither changes what happens on a push to main or on a pull request from a branch, where both secrets are present. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Coverage variation | ✅ +0.00% coverage variation (-1.00%) |
| Diff coverage | ✅ ∅ diff coverage |
Coverage variation details
Coverable lines Covered lines Coverage Common ancestor commit (837d1d0) 8978 921 10.26% Head commit (3dc392d) 8978 (+0) 921 (+0) 10.26% (+0.00%) Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch:
<coverage of head commit> - <coverage of common ancestor commit>
Diff coverage details
Coverable lines Covered lines Diff coverage Pull request (#122) 0 0 ∅ (not applicable) Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified:
<covered lines added or modified>/<coverable lines added or modified> * 100%
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
SONAR_TOKEN is currently set at job scope, unnecessarily exposing it to all steps/actions instead of only the scan step.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (2)
What changed in this PR
This PR adjusts CI workflows so dependabot-triggered runs (which do not receive repository secrets) don’t fail checks solely due to missing third-party tokens, while preserving behavior for normal branch pushes and PRs where secrets are available.
Changes:
- Marks the Codacy coverage upload step as best-effort so it won’t fail the overall test job.
- Skips the SonarCloud scan step when
SONAR_TOKENis unavailable (and moves token handling to enable that conditional).
| File | Description |
|---|---|
| .github/workflows/tests.yml | Makes Codacy coverage reporting non-blocking for CI success. |
| .github/workflows/sonarqube.yml | Skips SonarCloud scan when token is missing to avoid failing dependabot runs. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # At job level so the scan step's `if` can see it: a step cannot test an | ||
| # environment variable it defines itself. | ||
| env: | ||
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} |
| # without repository secrets, so CODACY_PROJECT_TOKEN is empty there | ||
| # and the action fails; that should not turn a passing test run red. | ||
| continue-on-error: true | ||
| if: runner.os != 'Windows' |
Dependabot pull requests run without repository secrets. On #114 the Go tests passed on ubuntu, macos and windows, and the pull request was still red:
The job log shows the step running with an empty
CODACY_PROJECT_TOKEN; windows passes only because it skips that step. It survived a rebase onto current main, so it is structural rather than stale — every dependabot pull request will land in the same state.Coverage upload is best-effort and now continues on error. gosn-v2 already does this, with the same reasoning in a comment: a missing or invalid token should not turn a passing test run red.
The SonarCloud scan cannot do anything without its token, so it is skipped when
SONAR_TOKENis empty rather than failing. The token moves to job level, because a step cannot test an environment variable it defines itself.Neither change affects a push to main or a pull request from a branch, where both secrets are present and both steps run as before.
🤖 Generated with Claude Code