ci: skip SonarCloud scan on Dependabot PRs (unblocks #918) - #926
Conversation
Dependabot PRs run without repository secrets, so SONAR_TOKEN is empty and the sonar-scanner step in the unit-tests-linux job fails with a 401 "Not authorized" — blocking every Dependabot PR (e.g. #918, the sonarqube-scan-action v4→v6 bump) even though the code and tests are fine (FAILED_SUITES: 0). Gate the scan step on `github.actor != 'dependabot[bot]'`. The quality gate still runs on branch pushes and same-repo PRs, which is where it matters; the scan legitimately cannot run in the secret-less Dependabot context. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe deployment workflow updates the SonarCloud analysis step to skip execution when the GitHub actor is ChangesSonarCloud workflow guard
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b780a29e9c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/deploy.yml (1)
1528-1556: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick winRestore the SonarCloud action invocation.
This step only has
with:inputs and nouses:orrun:key, so GitHub Actions has nothing executable for the named Sonar scanner step. Keep the Dependabot skip and add the pinnedSonarSource/sonarqube-scan-actionreference back.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/deploy.yml around lines 1528 - 1556, Restore the executable action invocation for the “Run sonar-scanner” step by adding the pinned SonarSource/sonarqube-scan-action reference before its existing with: arguments. Preserve the current Dependabot condition, environment variables, and scanner arguments unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/deploy.yml:
- Around line 1528-1556: Restore the executable action invocation for the “Run
sonar-scanner” step by adding the pinned SonarSource/sonarqube-scan-action
reference before its existing with: arguments. Preserve the current Dependabot
condition, environment variables, and scanner arguments unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: b73c2c81-9d17-4b95-a954-e87044c775bf
📒 Files selected for processing (1)
.github/workflows/deploy.yml
Review fix (Codex P1 + CodeRabbit Critical): the previous commit's edit dropped the 'uses: SonarSource/sonarqube-scan-action@v4' line while adding the Dependabot if-guard, leaving the step with no action to run — which would have made the whole workflow step invalid, not just skipped for Dependabot. Restore the uses line; the if-guard stays. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
1 participant
Problem
Dependabot PRs (e.g. #918, bumping
SonarSource/sonarqube-scan-actionv4→v6) are permanentlyBLOCKEDbecause theunit-tests-linuxjob's Run sonar-scanner step fails with:This is not a code problem — the tests all pass (
FAILED_SUITES: 0). GitHub deliberately withholds repository secrets from Dependabot-triggered workflow runs, soSONAR_TOKENis empty and the scan 401s. This blocks every Dependabot PR the same way.(The v4→v6 bump itself is safe for us: our
args:values contain no spaces, so the v6 arg-quoting breaking change doesn't apply.)Fix
Gate the sonar-scanner step on
github.actor != 'dependabot[bot]'. The SonarCloud quality gate still runs on branch pushes and same-repo PRs — where it actually matters — and simply skips in the secret-less Dependabot context instead of hard-failing.Effect
🤖 Generated with Claude Code
Summary by CodeRabbit