fix(ci): skip GHCR publish tests on dependabot PRs - #293
Merged
marcusburghardt merged 1 commit intoMay 29, 2026
Merged
Conversation
dependabot[bot] is not an org member, so the org membership check in reusable_publish_ghcr.yml always fails for dependabot PRs that touch GHCR-related files. The fork detection guard from complytime#291 does not help because dependabot branches live in the same repository. Add an actor exclusion so the GHCR integration test jobs skip cleanly for dependabot PRs instead of producing false failures. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
This was referenced May 29, 2026
Closed
trevor-vaughan
approved these changes
May 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dependabot[bot]is not an org member, so the org membership check inreusable_publish_ghcr.ymlalways fails for dependabot PRs that touch GHCR-related files (e.g., bumpingdocker/setup-qemu-action). The fork detection guard from #291 does not help because dependabot branches live in the same repository, not a fork.This adds a
github.actor != 'dependabot[bot]'condition to both GHCR test jobs (test-unprotected-org-memberandtest-attestations-override) so they skip cleanly instead of producing false failures.Related Issues
docker/setup-qemu-action)Review Hints
ci_test_publish_ghcr.yml: two identical one-line additions to existingifconditions (lines 38 and 197).reusable_publish_ghcr.ymlfor deeper validation of dependabot PRs without requiring GHCR push access.