From 893f48d1be7944f3730e5f552fcf012467afdca0 Mon Sep 17 00:00:00 2001 From: Ajit Pratap Singh Date: Sun, 25 Oct 2026 22:52:10 +0530 Subject: [PATCH] ci: skip claude-review on Dependabot PRs Dependabot-triggered workflows get no repository secrets, so the review action starts with an empty CLAUDE_CODE_OAUTH_TOKEN and fails (e.g. #863). Skip them like fork PRs; the maintainer reviews dependency bumps by hand. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01RkzVu3JY9Y6BRWfjesWts9 --- .github/workflows/claude-code-review.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 73497dc2c..b91c78b63 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -11,9 +11,13 @@ permissions: jobs: claude-review: # Fork PRs get a read-only GITHUB_TOKEN and no secrets, so the action fails - # with 403 when posting its comment. Skip them; maintainers can still - # request a review with an @claude comment. - if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository + # with 403 when posting its comment. Dependabot PRs likewise run without + # repository secrets (no CLAUDE_CODE_OAUTH_TOKEN). Skip both; maintainers + # review them by hand or request a review with an @claude comment. + if: >- + github.event_name == 'workflow_dispatch' || + (github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.user.login != 'dependabot[bot]') runs-on: ubuntu-latest permissions: