ci(gate): bump the hybrid-gate pin so dependabot PRs can pass - #6747
Merged
Conversation
The shared workflow's credential step exited 1 whenever FLEET_REPO_TOKEN was empty, regardless of whether any fleet dep needed it. Dependabot runs read a separate secret store and receive no Actions secrets, so that token is always empty for them — every dependabot PR failed the required gate by construction, before fmt/check/clippy/nextest ever ran. Measured here: dependabot #6679 died at that step while #6681, two hours earlier, passed it. The difference was how each run was triggered, not what it needed — which is why a caller-side needs_fleet_repo_token: false could not express it either. forkwright/.github#34 makes the step warn and continue. Every forkwright git dep is public, so anonymous fetch resolves; a genuine credential failure now surfaces at the fetch with the warning directly above it. This repo keeps needs_fleet_repo_token: true — it is standing insurance against anonymous-fetch rate limiting, and scripts/check-automation-pr-gates.py enforces it whenever Cargo.toml resolves a forkwright git dependency. Refs #6684
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The shared gate's "Configure git credentials for fleet deps" step exited 1 whenever
FLEET_REPO_TOKENwas empty — regardless of whether any fleet dependency needed it.Dependabot-triggered runs read a separate secret store and receive no Actions secrets, so that token is always empty for them. Every dependabot PR therefore failed the required gate by construction, before fmt / check / clippy / nextest ever ran.
Evidence
exit 1.The difference is how each run was triggered, not what it needed — which is also why a caller-side
needs_fleet_repo_token: falsecannot express the condition. A caller cannot know at declaration time whether this run will be handed the secret.What the bump brings
forkwright/.github#34 makes the step warn and continue. Every forkwright git dependency is public, so anonymous fetch resolves; a genuine credential failure now surfaces at the fetch itself with the warning immediately above it in the log, rather than pre-emptively failing runs that never needed a token.
963532686→54f1af7c711546304409593695e1258a91004453.This repo keeps
needs_fleet_repo_token: trueUnchanged deliberately. It is standing insurance against anonymous-fetch rate limiting on GitHub-hosted runners — the input's documented second criterion — and
scripts/check-automation-pr-gates.pyenforces it unconditionally wheneverCargo.tomlresolves any forkwright git dependency. The upstream change makes that input safe when the secret is absent; it does not make the input unnecessary.Verification
This PR's own gate, plus the next dependabot PR reaching a real verdict instead of dying at the credential step.
Refs #6684