Skip Pro CI workflows for Dependabot PRs#2825
Conversation
Dependabot PRs can't access the REACT_ON_RAILS_PRO_LICENSE secret, causing all Pro workflows to fail. Add an actor check to the detect-changes job in each Pro workflow so the entire workflow is skipped when triggered by Dependabot. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
✅ Files skipped from review due to trivial changes (2)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughThe PR adds job-level guards to three Pro-related GitHub Actions workflows to skip the Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Condition skips Pro CI on main for Dependabot merges
- Updated all three Pro workflow
detect-changesjob conditions to skip Dependabot only on pull_request events so push/main and workflow_dispatch still run.
- Updated all three Pro workflow
Or push these changes by commenting:
@cursor push dfbe9e07b2
Preview (dfbe9e07b2)
diff --git a/.github/workflows/pro-integration-tests.yml b/.github/workflows/pro-integration-tests.yml
--- a/.github/workflows/pro-integration-tests.yml
+++ b/.github/workflows/pro-integration-tests.yml
@@ -27,7 +27,7 @@
jobs:
detect-changes:
# Skip for Dependabot PRs — they can't access the Pro license secret
- if: github.actor != 'dependabot[bot]'
+ if: github.event_name != 'pull_request' || github.actor != 'dependabot[bot]'
permissions:
contents: read
actions: read
diff --git a/.github/workflows/pro-lint.yml b/.github/workflows/pro-lint.yml
--- a/.github/workflows/pro-lint.yml
+++ b/.github/workflows/pro-lint.yml
@@ -27,7 +27,7 @@
jobs:
detect-changes:
# Skip for Dependabot PRs — they can't access the Pro license secret
- if: github.actor != 'dependabot[bot]'
+ if: github.event_name != 'pull_request' || github.actor != 'dependabot[bot]'
permissions:
contents: read
actions: read
diff --git a/.github/workflows/pro-test-package-and-gem.yml b/.github/workflows/pro-test-package-and-gem.yml
--- a/.github/workflows/pro-test-package-and-gem.yml
+++ b/.github/workflows/pro-test-package-and-gem.yml
@@ -27,7 +27,7 @@
jobs:
detect-changes:
# Skip for Dependabot PRs — they can't access the Pro license secret
- if: github.actor != 'dependabot[bot]'
+ if: github.event_name != 'pull_request' || github.actor != 'dependabot[bot]'
permissions:
contents: read
actions: read![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
|
||
| jobs: | ||
| detect-changes: | ||
| # Skip for Dependabot PRs — they can't access the Pro license secret |
There was a problem hiding this comment.
The use of github.actor (rather than github.triggering_actor) means that manually re-running this workflow on a Dependabot PR will still be skipped, because github.actor stays as dependabot[bot] even when a human clicks Re-run. Only a workflow_dispatch with force_run: true can override this.
This is probably fine — it prevents accidental Pro-secret access — but worth a note so maintainers know the escape hatch:
| # Skip for Dependabot PRs — they can't access the Pro license secret | |
| # Skip for Dependabot PRs — they can't access the Pro license secret. | |
| # To run Pro CI on a Dependabot PR, use workflow_dispatch with force_run: true | |
| # (re-running the workflow will NOT help because github.actor stays as dependabot[bot]). | |
| if: github.actor != 'dependabot[bot]' |
Code ReviewOverall: Correct, minimal, and safe. The three-line change is the right approach — gating A few things worth knowing: Re-run behaviour (inline comment posted): Delayed detection of Pro-only breakages: Worth acknowledging explicitly — a dependency bump that breaks something Pro-specific won't surface until after merge, when the push to Actor string: |
Greptile SummaryThis PR adds Key points:
Confidence Score: 5/5
Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Workflow triggered] --> B{Is Dependabot actor?}
B -- Yes --> C[detect-changes: SKIPPED]
C --> D[All downstream jobs: SKIPPED]
B -- No --> E[detect-changes: RUN]
E --> F{force_run or full-ci label?}
F -- Yes --> G[All downstream jobs: RUN]
F -- No --> H[ci-changes-detector script]
H --> I{Relevant changes?}
I -- Yes --> G
I -- No --> J[Downstream jobs: SKIPPED]
Reviews (1): Last reviewed commit: "Skip Pro CI workflows for Dependabot PRs..." | Re-trigger Greptile |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
The previous condition `github.actor != 'dependabot[bot]'` would also skip Pro CI on push-to-main when Dependabot merges via auto-merge or `@dependabot merge`. Scope the check so push and workflow_dispatch events always run Pro CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace nested ternary expressions with if/else blocks in create-app.ts and index.ts to satisfy the no-nested-ternary lint rule. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Review: Skip Pro CI for Dependabot PRsOverall: LGTM with one readability nit and a structural note. GitHub Actions changes ✅The
One readability nit on the condition expression — see inline comment. Applies identically to all three workflow files. TypeScript refactoring ✅ (but unrelated)The However, this refactoring is unrelated to the Dependabot CI fix. Bundling unrelated changes makes No security concernsThe approach is sound: rather than trying to pass secrets to Dependabot PRs (which GitHub explicitly blocks), the entire Pro workflow is simply skipped. Post-merge push to main still validates the Pro suite with full secret access. |
|
Code Review - PR 2825 Overall: Ready to merge. The core change is correct and well-implemented. GitHub Actions condition (3 workflow files) Logic verification:
Note on PR description: The summary bullets describe the simpler TypeScript changes (create-app.ts, index.ts) Verified correct:
|
| detect-changes: | ||
| # Skip Dependabot PRs — they can't access the Pro license secret. | ||
| # Scoped to pull_request so push-to-main after merge still runs Pro CI. | ||
| if: github.event_name != 'pull_request' || github.actor != 'dependabot[bot]' |
There was a problem hiding this comment.
Condition logic is correct. The github.event_name != 'pull_request' guard is essential — without it, push events triggered when a Dependabot PR is merged into main would also be skipped, silently leaving Pro CI dark on main after every Dependabot merge.
The PR description summary still says if: github.actor != 'dependabot[bot]' (the simpler, broader form). Worth updating the description to match the actual condition so the scoping intent is clear to future readers.
| let proModeLabel: string | null = null; | ||
| if (options.rsc) { | ||
| proModeLabel = '--rsc'; | ||
| } else if (options.pro) { | ||
| proModeLabel = '--pro'; | ||
| } |
There was a problem hiding this comment.
Functionally equivalent to the previous ternary — RSC still takes precedence over --pro, and proModeLabel remains null when neither flag is set (which can only happen when proRequested is also false, so the null is never reached in a live code path).
One observation: these changes are unrelated to the PR's Dependabot CI purpose. Bundling them here makes future git bisect and changelog attribution harder. Consider a separate commit or PR for readability changes.
|
Re: the note about the TypeScript refactoring being unrelated — agreed they're separate concerns, and they're already in distinct commits ( |
size-limit report 📦
|
## Summary - Stamp `### [16.5.0.rc.0]` version header with today's date - Add 10 new changelog entries for PRs merged since v16.4.0 - Fix incomplete PR 2818 entry (missing author link) ### New entries added **Added:** - `create-react-on-rails-app --pro` support (PR 2818) - Global prerender env override `REACT_ON_RAILS_PRERENDER_OVERRIDE` (PR 2816) - `react_on_rails:sync_versions` rake task (PR 2797) - Pro/RSC setup checks in `react_on_rails:doctor` (PR 2674) **Changed:** - [Pro] Canonical env var for worker count is now `RENDERER_WORKERS_COUNT` (PR 2611) **Improved:** - Smoother `create-react-on-rails-app` and install generator flows (PR 2650) - Pro upgrade hint after install (PR 2642) **Fixed:** - Preserve runtime env vars across `Bundler.with_unbundled_env` (PR 2836) - Fix doctor prerender check and ExecJS display for Pro/RSC apps (PR 2773) - Fix doctor false positives for custom layouts (PR 2612) ### Skipped PRs (not user-visible) Docs-only: #2845, #2842, #2826, #2830, #2820, #2809, #2803, #2785, #2801, #2791, #2789, #2788, #2772, #2778, #2780, #2784, #2671, #2676, #2662, #2657, #2669 CI/internal tooling: #2825, #2817, #2819, #2812, #2815, #2810, #2808, #2807, #2634, #2798, #2761, #2760, #2658, #2639, #2667, #2656 ## Test plan - [x] Verified version header and diff links are correct - [x] Verified all entries follow changelog formatting conventions - [x] Verified file ends with newline - [ ] After merge, run `rake release` to publish 16.5.0.rc.0 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Documentation-only change updating `CHANGELOG.md` with a new `16.5.0.rc.0` section and compare links; no runtime code is modified. > > **Overview** > Adds a new `16.5.0.rc.0` (2026-03-25) section to `CHANGELOG.md`, consolidating recent PR entries under **Added/Changed/Improved/Fixed** and correcting the previously incomplete `--pro` CLI entry author attribution. > > Updates the bottom compare links so `[unreleased]` now compares from `v16.5.0.rc.0` and adds a link definition for `[16.5.0.rc.0]`. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 481a71c. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes - v16.5.0.rc.0 * **New Features** * Added sync_versions task for streamlined version management * Expanded doctor checks for Pro and RSC support * **Improvements** * Enhanced generator workflow and Pro upgrade guidance * Improved environment variable handling and preservation * **Bug Fixes** * Fixed detection issues with doctor tools and ExecJS/prerender functionality <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…olve-2835 * origin/main: (21 commits) docs: fix profiling node renderer command (#2863) generators: point Pro install fallback to upgrade guide (#2868) Add RSC Flight payload optimization guide (Article 7) (#2827) Migrate from deprecated Async::Variable to Async::Promise (#2832) docs: turn pro quick start into a gateway (#2862) Fix upload-assets endpoint duplicating bundles across directories (#2768) docs: fix stale docs links and help URLs (#2850) docs: replace dead pro.reactonrails.com links (#2851) docs: refresh generator and helper URLs (#2852) Add standalone RSC upgrade guide for existing Pro apps (#2831) Raise docs version floor to 16.4.0 in install/demo guidance (#2610) Fix release script: require changelog, fix RC version computation (#2848) Bump version to 16.5.0 Bump version to 16.5.0.rc.0 Update CHANGELOG.md for 16.5.0.rc.0 (#2847) Docs: add memory leak prevention guide for Node Renderer SSR (#2845) Docs: fix RSC migration gaps found during real-world migration (#2842) Add common mistakes sections to RSC migration guides (#2826) fix: preserve runtime env vars across Bundler.with_unbundled_env (#2836) Skip Pro CI workflows for Dependabot PRs (#2825) ... # Conflicts: # CHANGELOG.md
1 participant
Summary
if: github.actor != 'dependabot[bot]'to thedetect-changesjob in all three Pro workflows (pro-integration-tests.yml,pro-lint.yml,pro-test-package-and-gem.yml)need: detect-changes, so the entire workflow is skipped for Dependabot PRsCloses #2171
Test plan
workflow_dispatchstill works withforce_run🤖 Generated with Claude Code
Note
Low Risk
Low risk: changes only add conditional guards to GitHub Actions workflows and refactor CLI logging/labels without altering core generation behavior.
Overview
Prevents Pro GitHub Actions workflows from running on Dependabot pull requests by adding an
ifguard to the shareddetect-changesjob in the Pro workflows, effectively skipping all downstream jobs that require Pro license secrets.Refactors
create-react-on-rails-appmode labeling to use explicitif/elseprecedence (--rscover--pro) for both the generator step label (proModeLabel) and the initial console output (modeLabel).Written by Cursor Bugbot for commit 07735a2. This will update automatically on new commits. Configure here.
Summary by CodeRabbit