ci: let claude-code-review run on Dependabot pull requests - #408
Merged
Conversation
The action rejects non-human actors unless they are listed, so every Dependabot PR failed at startup with "Workflow initiated by non-human actor: dependabot (type: Bot)" and was never actually reviewed. Allows dependabot[bot] by name rather than "*", so that on a public repo another installed App cannot invoke the action with a prompt it controls. Requires CLAUDE_CODE_OAUTH_TOKEN to also exist as a Dependabot secret: GitHub does not expose Actions secrets to Dependabot-triggered runs, and the repo currently has no Dependabot secrets, so the token resolves empty until one is added.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
claude-code-reviewhas never actually reviewed a dependency bump. Every Dependabot PR fails at startup with:This allows
dependabot[bot]by name rather than*— cookcli is public, and*would let any other installed App invoke the action with a prompt it controls.One manual step is still needed
GitHub does not pass Actions secrets to Dependabot-triggered runs; they read from a separate Dependabot secret store. Right now:
CLAUDE_CODE_OAUTH_TOKENexists under Actions secrets ✅So until
CLAUDE_CODE_OAUTH_TOKENis also added under Settings → Secrets and variables → Dependabot, the token resolves to an empty string and the job will still fail — just with an auth error instead of the bot error. It fails today either way, so this is not a regression, but the check only goes green once that secret exists.Worth knowing: once it works, every dependency bump consumes Claude usage.