From c8335230a67a8b67c93e0d7c1b84751142031505 Mon Sep 17 00:00:00 2001 From: Jonas Daniels Date: Fri, 23 Oct 2026 09:15:57 -0700 Subject: [PATCH 1/2] ci: skip the review smoke on Dependabot pull requests A run that Dependabot triggers gets the Dependabot secrets, not the Actions secrets, so OPENROUTER_API_KEY is empty and all three review jobs fail before testing anything. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/review-smoke.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/review-smoke.yml b/.github/workflows/review-smoke.yml index 1b8c59e..852b724 100644 --- a/.github/workflows/review-smoke.yml +++ b/.github/workflows/review-smoke.yml @@ -40,8 +40,11 @@ jobs: dir: examples/review-smoke-dashboard - app: cli dir: examples/review-smoke-cli - # A pull request from a fork gets no secrets, so the review could not run. - if: github.event.pull_request.head.repo.full_name == github.repository + # A pull request from a fork gets no secrets, and one from Dependabot gets + # only the Dependabot secrets, so the review could not run on either. + if: >- + github.event.pull_request.head.repo.full_name == github.repository && + github.actor != 'dependabot[bot]' runs-on: ubuntu-latest # The explorer alone may use its 20 minutes; the base build and the judge come after. timeout-minutes: 45 From c15a0b7cd11eb32cf40bac8182c97530ccc42c7c Mon Sep 17 00:00:00 2001 From: Jonas Daniels Date: Fri, 23 Oct 2026 09:17:44 -0700 Subject: [PATCH 2/2] ci: pin setup-node in the review Action to a commit SHA #94 pinned the workflows but left action.yml on a tag. agent-labs-dev now rejects unpinned actions, so the review smoke fails at the setup-node step on every pull request. Co-Authored-By: Claude Opus 5.5 --- action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/action.yml b/action.yml index dfce0e0..46472ef 100644 --- a/action.yml +++ b/action.yml @@ -40,7 +40,7 @@ inputs: runs: using: composite steps: - - uses: actions/setup-node@v7 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ inputs.node-version }}