fix(ci): skip the Claude review when its token is unavailable - #455
Merged
Conversation
Dependabot-triggered runs read from the Dependabot secret store rather than
the Actions one, so CLAUDE_CODE_OAUTH_TOKEN is empty and the action fails
validation:
Action failed with error: Environment variable validation failed:
- Either ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, ... is required
That is a check that can never go green on a dependency PR, which leaves
every Dependabot PR permanently red and stalls `@dependabot merge`, since it
waits for CI to pass. Fork PRs get no secrets either and fail the same way.
Gate the review on the token being present, so it skips rather than fails,
and warn in the run summary so a genuinely misconfigured token stays visible.
Adding the token to the repo's Dependabot secrets re-enables the review for
dependency PRs, which is what `allowed_bots: dependabot[bot]` intends.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every Dependabot PR has a red
claude-reviewcheck. The cause is not the code under review:Dependabot-triggered runs read from the Dependabot secret store, not the Actions one, so
secrets.CLAUDE_CODE_OAUTH_TOKENresolves to an empty string and the action fails validation before it reviews anything. Fork PRs get no secrets either and fail identically.This is not cosmetic:
@dependabot mergewaits for CI to pass, so a check that can never pass stalls it indefinitely. That is currently blocking #447, #448, #449, #451, #452 and #453, all of which have fully greenTestsuites.Change
Gate the checkout and review steps on the token actually being present. When it isn't, the job skips those steps and succeeds, emitting a
::warning::so a genuinely misconfigured token is still visible in the run summary rather than silently swallowed.This deliberately preserves the existing
allowed_bots: "dependabot[bot]"intent — reviewing dependency PRs is desirable, it has simply never been able to work. AddingCLAUDE_CODE_OAUTH_TOKENto the repository's Dependabot secrets (Settings → Secrets and variables → Dependabot) turns the review back on for those PRs, and this workflow then picks it up with no further edit.Verification
YAML parses and the two gated steps carry the guard; the credential check itself is ungated so the job always reports. Behaviour on this PR is itself the test: it is not a Dependabot PR, so the token is present and
claude-reviewshould run and review normally.