You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Don't try to login to quay if a push is made by dependabot (#96)
## Description
Avoids logging into quay for dependabot builds.
## Why is this needed
Fixes#92
Dependabot PRs are different than other non-contributor PRs in that the branch comes from this repo, which normally allows the secret to be available for CI yet the builds still fail (see [1], [2]). It seems that GitHub does not make secrets available for these PRs as yet another special case [3]. If we skip logging in to quay for dependabot then we side step this all together.
Dependabot pushes/PRs can be recognized by the github.actor value according to the GitHub docs [3].
[1]: #89
[2]: #95
[3]: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions#handling-pull_request-events
I wanted to avoid logging in for non main pushes all together but that may make kernel testing harder than strictly necessary.
## How Has This Been Tested?
CI?
## How are existing users impacted? What migration steps/scripts do we need?
Updated dependencies sooner hopefully.
0 commit comments