Repository navigation
ci: fix the review smoke on Dependabot PRs and under SHA pinning - #96
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
A run that Dependabot triggers gets the Dependabot secrets, not the Actions secrets, so OPENROUTER_API_KEY is empty and all three review jobs fail before testing anything. Co-Authored-By: Claude Opus 5.5 <[email protected]>
#94 pinned the workflows but left action.yml on a tag. agent-labs-dev now rejects unpinned actions, so the review smoke fails at the setup-node step on every pull request. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jnsdls
force-pushed
the
ci/skip-review-smoke-on-dependabot
branch
from
October 23, 2026 16:17
044819d to
c15a0b7
Compare
jnsdls
changed the title
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two fixes for the review smoke, which fails on every pull request right now.
Unpinned setup-node in action.yml. #94 pinned the workflows but left
actions/setup-nodeinaction.ymlon a tag. agent-labs-dev now requires SHA-pinned actions, so all three review jobs stop at that step. This pins it to the same v7.1.0 commit the workflows use. Nouses:in the repo is left on a tag, apart from the local./.Dependabot PRs. A run that Dependabot triggers gets the Dependabot secrets, not the Actions secrets.
OPENROUTER_API_KEYcame through empty on #95 and the jobs exited with code 2 before testing anything. The jobs now skip whengithub.actorisdependabot[bot], the same way fork PRs already skip. I didn't copy the key into Dependabot secrets. A dependency bump has no app change to review, and the key would reach any code a bumped dependency runs.Dependabot pins in
action.ymlget bumped by the existing github-actions config, since it scans/.🤖 Generated with Claude Code