From a42ac9b30a9e94446a64fc5a2568b1135e07ca2b Mon Sep 17 00:00:00 2001 From: Thomas Cederholm Date: Mon, 10 Aug 2026 17:29:04 +0200 Subject: [PATCH] ci: Use DEPENDABOT_AUTH for dependabot-triggered Sonar scans Dependabot-triggered runs read the Dependabot secret store rather than the Actions one, so `secrets.SECRET_AUTH` resolves to an empty string. The sonar-scanner action then fails to authenticate with Secret Manager and cannot load the github-token secret, surfacing as the misleading `Missing env var: GITHUB_TOKEN`. Select DEPENDABOT_AUTH only when dependabot is the actor, leaving every human-authored run on SECRET_AUTH unchanged. Evidence this is actor-scoped rather than code-scoped: on a single dependabot commit, commit-msg, pre-commit and the ASVS gate all pass and only CI fails -- it is the one workflow that reads the secret. Rebasing or recreating those PRs cannot help, since both preserve dependabot as the triggering actor. --- .github/workflows/pull_request.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pull_request.yaml b/.github/workflows/pull_request.yaml index 1ff2619..1754959 100644 --- a/.github/workflows/pull_request.yaml +++ b/.github/workflows/pull_request.yaml @@ -31,4 +31,7 @@ jobs: sonar-host: https://sonarcloud.io sonar-scanner: maven main-branch: master - service-account-key: ${{ secrets.SECRET_AUTH }} + # Dependabot-triggered runs read the Dependabot secret store, where + # SECRET_AUTH does not exist. Fall back to the Dependabot-scoped key + # for those runs only. + service-account-key: ${{ github.actor == 'dependabot[bot]' && secrets.DEPENDABOT_AUTH || secrets.SECRET_AUTH }}