Repository navigation
fix(ci): skip gitleaks secret-scan on Dependabot PRs (#832) - #1251
Conversation
Dependabot PRs execute with the Dependabot secret store rather than the Actions store, so `secrets.GITLEAKS_LICENSE` resolves to empty and the org-licensed gitleaks-action hard-fails with "missing gitleaks license". This was the dominant cause of ci.yml's failure-rate WARNING (fleet-tracker .github-private#832): 28 of the last 30 ci.yml failures were Dependabot branches; the remaining 2 were unrelated Lint failures. Dependabot only bumps pinned action SHAs / manifest versions, which have no secret-introduction surface, and the post-merge `push: [main]` run re-scans full history with the license present — so gating the PR-time scan on `github.actor != 'dependabot[bot]'` loses no real coverage while clearing the recurring failures. Refs: #832 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Juznz5V6su81ffSND8fg7s
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 25 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR reduces CI noise in .github-private by preventing the secret-scan (gitleaks) job from running on Dependabot pull requests where the required org license secret is unavailable, addressing the elevated failure-rate warning reported in fleet-tracker #832.
Changes:
- Add an
if:condition to thesecret-scanjob to skip Dependabot-triggered PR runs. - Add inline documentation explaining why skipping Dependabot PR secret scans is acceptable given post-merge scanning on
push: main.
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: f67672ca97c81f3a73966ffedafeb7b2366e7020
Review mode: triage-approved (single reviewer)
Summary
Single-file CI fix: gates the gitleaks secret-scan job with 'if: github.actor != dependabot[bot]' so Dependabot PRs (which run with the Dependabot secret store where GITLEAKS_LICENSE is empty) no longer hard-fail ci.yml. Root cause, coverage claims, and CI health all verified; triage low-risk assessment confirmed.
Linked issue analysis
Closes #832 (Fleet Monitor WARNING: ci.yml failure rate 10.1%, 30/298 runs). The PR's evidence attributes 28 of the last 30 failures to the gitleaks license failure on Dependabot branches. Skipping the PR-time scan for Dependabot removes the dominant failure cause, so the issue is substantively addressed — the failure rate should age below the 10% threshold.
Findings
Verified:
- The
if: github.actor != 'dependabot[bot]'gate is the GitHub-documented pattern for Dependabot's separate secret store; the failure mode (missing gitleaks licenseon org accounts) is real. - Coverage is preserved:
ci.ymltriggers onpush: [main]and the secret-scan job checks out withfetch-depth: 0, so the post-merge run re-scans full history with the license available. Dependabot content (pinned SHA / manifest bumps) has no meaningful secret-introduction surface. - The inline comment documents the rationale well.
Minor (non-blocking):
- The condition applies to all events, including
push. If a push to main is ever actored bydependabot[bot](e.g.,@dependabot merge), that one post-merge scan would also skip. This self-heals — the next non-Dependabot push re-scans full history — butif: github.event_name == 'push' || github.actor != 'dependabot[bot]'would be airtight if you want it.
Note: the run_secret_scanning MCP tool was unavailable in this run; the diff contains no secret-bearing content (a comment block and an if: expression only), and the gitleaks CI check passed on this PR.
CI status
All checks green at f67672c: Lint, ShellCheck, bats, unit-tests, Secret scan (gitleaks), Agent Security Scan, CodeQL (actions + python), SonarCloud (Quality Gate passed, 0 new issues / 0 hotspots), AgentShield, holdout-guard, template-drift, gh-aw-compile, and all other checks SUCCESS; remaining entries are expected SKIPPED (Dependabot automerge, mention triggers, ecosystem-specific audits). Branch is BEHIND main but MERGEABLE — needs a mechanical update before merge.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: aff16583f45a7d08fbcd8f7f64f1c86227ae3cd2
Review mode: triage-approved (single reviewer)
Summary
Single-file CI fix (+7 lines in .github/workflows/ci.yml): gates the gitleaks secret-scan job with if: github.actor != 'dependabot[bot]' so Dependabot PRs — which run with the Dependabot secret store where GITLEAKS_LICENSE is empty — no longer hard-fail ci.yml. Triage assessment confirmed; head commit aff1658 only merges main into the branch with no content changes beyond the original fix.
Linked issue analysis
Closes #832 (Fleet Monitor WARNING: ci.yml failure rate 10.1%, 30/298 runs). The PR attributes 28 of the last 30 ci.yml failures to the gitleaks license hard-fail on Dependabot branches. Gating the PR-time scan removes the dominant failure cause, so the failure rate should age below the 10% threshold — the issue is substantively addressed.
Findings
Verified:
- The
if: github.actor != 'dependabot[bot]'gate is the GitHub-documented pattern for Dependabot's separate secret store; the org-license hard-fail ("missing gitleaks license") is a real failure mode of gitleaks-action. - Coverage preserved: ci.yml triggers on
push: [main]and the secret-scan job checks out withfetch-depth: 0, so every merge is re-scanned across full history with the license present. Dependabot content (pinned action SHAs / manifest version bumps) has no meaningful secret-introduction surface. - The inline comment documents the rationale clearly.
- Diff since prior review (f67672c → aff1658) is a merge of main only — no new changes to review.
Minor (non-blocking, carried from prior review):
- The condition applies to all events including
push; a push to main actored bydependabot[bot](e.g.,@dependabot merge) would skip that one post-merge scan. Self-healing on the next non-Dependabot push, butif: github.event_name == 'push' || github.actor != 'dependabot[bot]'would be airtight.
Note: the run_secret_scanning MCP tool was unavailable in this run; the diff contains no secret-bearing content (a comment block and an if: expression), and the gitleaks CI check passed on this PR.
CI status
All checks green at aff1658: Lint, ShellCheck, bats, unit-tests, Secret scan (gitleaks), Agent Security Scan, CodeQL (actions + python), SonarCloud (Quality Gate passed, 0 new issues / 0 hotspots), AgentShield, holdout-guard, template-drift, gh-aw-compile, validate-* jobs all SUCCESS; remaining entries are expected SKIPPED (Dependabot automerge, ecosystem-specific audits, dev-lead ci-relay). Branch is BEHIND main but MERGEABLE — needs a mechanical branch update before merge.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at aff1658.
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1251 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 3e7cabb6916f321f7d4191d6e5840c8c1de7cfc0
Review mode: triage-approved (single reviewer)
Summary
Single-file CI fix (+11 lines in .github/workflows/ci.yml): gates the gitleaks secret-scan job so Dependabot PRs (which use the Dependabot secret store where GITLEAKS_LICENSE is empty) no longer hard-fail ci.yml. Since the prior review (aff1658), commit 3e7cabb applied Copilot's suggested hardening — gating on the immutable PR author (github.event.pull_request.user.login) with an explicit push-event guard instead of the re-run-mutable github.actor. Triage low-risk assessment confirmed; all decision gates pass.
Linked issue analysis
Closes #832 (Fleet Monitor WARNING: ci.yml at 10.1% failure rate). Root cause verified: 28/30 recent failures were Dependabot branches hard-failing on the missing gitleaks org license. The gate removes exactly that failure mode. Coverage is preserved: dependabot[bot] is a reserved app slug (brackets are invalid in usernames, so no spoofing), Dependabot diffs are pinned-SHA/version bumps with no secret-introduction surface, and the post-merge push-to-main run always executes (github.event_name == 'push' short-circuits true) and re-scans full history with the license present.
Findings
No blocking findings.
- The condition is correct for both workflow triggers (push: main, pull_request: main). On pull_request, github.event.pull_request.user.login is set at PR creation and immutable across re-runs, closing the gap Copilot flagged on the earlier github.actor version.
- The single prior review thread (copilot-pull-request-reviewer, actor-vs-author) is resolved and outdated — fixed in 3e7cabb.
- Changes since prior reviewed SHA aff1658: two clean merges from main (unrelated automated commits) plus the 3e7cabb hardening fix. No new issues introduced.
- Secret-scanning MCP tool not available in this session; noted per protocol. Diff content is a comment block and an if: expression — no secret material. The gitleaks CI check itself passed on this PR.
CI status
All checks green on head 3e7cabb: Lint, ShellCheck, bats, unit-tests, CodeQL (actions + python), SonarCloud quality gate, AgentShield, Agent Security Scan, Secret scan (gitleaks), template-drift, holdout-guard, and all validators SUCCESS. A few cancelled dev-lead/review runs were superseded by successful re-runs of the same jobs on the same commit. mergeStateStatus BLOCKED only reflects the pending required review (reviewDecision REVIEW_REQUIRED).
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Problem
ci.ymltripped the Fleet Monitor failure-rate WARNING (fleet-tracker #832, 10.1% over the window). Root cause: thesecret-scan(gitleaks) job hard-fails on every Dependabot PR.Dependabot PRs run with the Dependabot secret store, not the Actions store, so
secrets.GITLEAKS_LICENSEis empty. gitleaks-action requires a license for organization accounts and exits with🛑 missing gitleaks license.Evidence — 28 of the last 30 ci.yml failures were Dependabot branches (one actions-group bump retried repeatedly); the other 2 were unrelated
Lintfailures on feature branches (normal, self-correcting).Fix
Gate the
secret-scanjob ongithub.actor != 'dependabot[bot]'.Why this loses no coverage:
push: [main]run re-scans full history (fetch-depth: 0) with the license present, so anything merged is still scanned.Verification
python3 -c yaml.safe_loadon ci.yml → OK (actionlint runs in CI).Closes #832
🤖 Generated with Claude Code
https://claude.ai/code/session_01Juznz5V6su81ffSND8fg7s