From c34a1fc0041756e7223d51d832ce2b2afb890d22 Mon Sep 17 00:00:00 2001 From: Edward Sun Date: Mon, 29 Jun 2026 00:12:49 -0700 Subject: [PATCH 1/2] ci: skip the Codex review job for Dependabot PRs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot pushes to a same-repo branch, so the existing fork guard (head.repo == repository) does not exclude it — but pull_request runs for Dependabot are withheld repository secrets, so the Codex step fails with no OPENAI_API_KEY and every Dependabot PR shows a spurious "Codex Review" failure. Extend the guard to also skip github.actor == dependabot[bot], mirroring the fork skip for the same no-secret-access reason. --- .github/workflows/codex-review.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml index cdcdef38..c9a81538 100644 --- a/.github/workflows/codex-review.yml +++ b/.github/workflows/codex-review.yml @@ -25,8 +25,13 @@ jobs: codex: name: Codex Review runs-on: ubuntu-latest - # Skip forks (no secret access) so they don't show a spurious failure. - if: github.event.pull_request.head.repo.full_name == github.repository + # Skip forks and Dependabot (neither gets secret access) so they don't show + # a spurious failure. Dependabot pushes to a same-repo branch, so the fork + # check below does not catch it — pull_request runs for Dependabot are + # withheld secrets, so the Codex step would fail with no OPENAI_API_KEY. + if: >- + github.event.pull_request.head.repo.full_name == github.repository && + github.actor != 'dependabot[bot]' permissions: contents: read outputs: From 622f7d985e939155488d31c10e461f534ce8f7d2 Mon Sep 17 00:00:00 2001 From: Edward Sun Date: Mon, 29 Jun 2026 00:40:30 -0700 Subject: [PATCH 2/2] ci: guard on pull_request.user.login (PR author) not github.actor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit github.actor is whoever triggered the run — a maintainer who reopens a Dependabot PR would re-run the secret-less job. pull_request.user.login is the PR author, the stable identity for the no-secret-access skip. --- .github/workflows/codex-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml index c9a81538..87ae798e 100644 --- a/.github/workflows/codex-review.yml +++ b/.github/workflows/codex-review.yml @@ -31,7 +31,7 @@ jobs: # withheld secrets, so the Codex step would fail with no OPENAI_API_KEY. if: >- github.event.pull_request.head.repo.full_name == github.repository && - github.actor != 'dependabot[bot]' + github.event.pull_request.user.login != 'dependabot[bot]' permissions: contents: read outputs: