From f572465c7a7301ec8fdfce6bfcb7305a14a9a884 Mon Sep 17 00:00:00 2001 From: Michael Daniels Date: Fri, 8 May 2026 14:07:35 -0400 Subject: [PATCH] workflows/pull-request-target: don't try to use secrets in pull_request context on Dependabot PRs Secrets can't be accessed on dependabot PRs (https://github.com/dependabot/dependabot-core/issues/3253#issuecomment-852541544), so don't try. (This should be the only change needed, as all other uses of secrets seem to be conditioned on pull_request not being the current event.) Fixes (e.g.) https://github.com/NixOS/nixpkgs/actions/runs/25553044633/job/75065769199?pr=518033 --- .github/workflows/pull-request-target.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pull-request-target.yml b/.github/workflows/pull-request-target.yml index 01d5691a6773..bff2dc88c72f 100644 --- a/.github/workflows/pull-request-target.yml +++ b/.github/workflows/pull-request-target.yml @@ -46,7 +46,7 @@ jobs: # It's fine to reuse this app in the 'eval / compare' job, # because this job has to run before that one. - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 - if: vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID + if: vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID && github.actor != 'dependabot[bot]' id: app-token with: client-id: ${{ vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID }}