Skip to content

fix(ci): allow Dependabot to receive automated review #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Jamie-BitFlight wants to merge 3 commits into
base: main
Choose a base branch
from
Open

fix(ci): allow Dependabot to receive automated review #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
52b89ed
fix(ci): allow Dependabot to receive automated code review
Jamie-BitFlight Oct 11, 2026
d48dfbd
docs(ci): document the verified Dependabot review secret prerequisite
Jamie-BitFlight Oct 11, 2026
c6299e5
Merge verified main while preserving Dependabot credential guidance
Jamie-BitFlight Oct 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,3 +67,7 @@ When adding new workflows:
- `action.yml` - Action definition file
- `package.json` - Contains version and scripts
- `biome.json` - Lint and formatting configuration

### claude-code-review.yml

Automated review accepts human contributors and the `dependabot[bot]` actor. Dependabot-triggered runs read Dependabot secrets, so configure `CLAUDE_CODE_OAUTH_TOKEN` under repository Settings → Secrets and variables → Dependabot as well as the Actions secret used by human-triggered runs. Keep the token in GitHub's secret stores. Verify a real Dependabot-triggered review after configuration; a successful human-triggered review does not establish that the bot received credentials.

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the required-secrets inventory

When an administrator follows this README to configure the repository, the Required Secrets section still states that nothing beyond GITHUB_TOKEN is needed, while this paragraph and .github/workflows/claude-code-review.yml:39 require CLAUDE_CODE_OAUTH_TOKEN. These contradictory instructions can leave human or Dependabot reviews unauthenticated; list the token and its required Actions/Dependabot scopes in that section and remove the blanket statement.

Useful? React with 👍 / 👎.

1 change: 1 addition & 0 deletions .github/workflows/claude-code-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ jobs:
id: claude-review
uses: anthropics/claude-code-action@v1
with:
allowed_bots: 'dependabot[bot]'

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add the OAuth token to Dependabot secrets

When this workflow is triggered by a Dependabot PR, allowing the bot only gets execution past the actor check: secrets.CLAUDE_CODE_OAUTH_TOKEN is populated from the Dependabot secret store, not the existing GitHub Actions secret store. Unless the same token has separately been configured as a Dependabot secret, the action will proceed without Claude authentication and these reviews will still fail. Provision and document the same-named Dependabot secret before enabling the bot; GitHub explicitly requires this for workflows used by both Dependabot and human actors in its Dependabot Actions guidance.

Useful? React with 👍 / 👎.

@Jamie-BitFlight Jamie-BitFlight Oct 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified from the actual Dependabot review log (job 114302823497): ALL_INPUTS has an empty claude_code_oauth_token, and CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY are empty. This is a real external prerequisite, not only the default secret model. The connector cannot list or provision Dependabot secrets. Keeping this finding unresolved and this PR unmerged until an administrator supplies the same-named Dependabot secret and a real bot-triggered review passes.

claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
plugins: 'code-review@claude-code-plugins'
Expand Down
Loading