24

I have a repository with Dependabot in it, that opens PR on version updates, etc which I would like to keep.

In the same repository, I have a GitHub Action for Pull Requests for my team to use.

My issue is that the Dependabot keeps triggering the Pull Request action no matter what I tried.

My PR action have to be triggered on staging branch pull requests, like so:

name: Pull Request
on:
  pull_request:
    branches:
      - staging

So I can't use both on pull_reuqest AND branches_ignore - as stated in the documentation

Workflow attempts I have tried so far that unfortunately haven't worked:

name: Pull Request
on:
  pull_request:
    branches:
      - staging
      - '!dependabot/**'

name: Pull Request
on:
  pull_request:
    branches:
      - staging

jobs:
  Build:
    if: github.actor!= 'dependabot-preview[bot]'
    name: Build
    runs-on: ubuntu-latest
    steps:
    - name: Check out code
      uses: actions/checkout@v2

I have also tried excluding the Dependabot user like so:

if: github.actor!= 'depbot'

Would love some insights or answers on how you have dealt with this issue.

Thanks!

Amitb
  • 372
  • 2
  • 10
  • 1
    Can you print the `github.actor`, like so: `- run: echo ${{ github.actor }}`. What does it say? – rethab Mar 31 '22 at 05:42
  • You may want to check if dependabot is triggering other workflow conditions like `push`. When it creates PR, that could be counted as a push to your repository too, that's what happened in my case. – Abel Cheung Apr 11 '22 at 14:40

1 Answers1

38

I guess there were many changes over the years and you can find outdated ways all over the web. The actual way is documented in the Dependabot documentation

if: ${{ github.actor != 'dependabot[bot]' }}

Note that nowadays you can also check the github.triggering_actor - if you want workflow to be skipped if Dependabot triggered it, but want to be able to manually trigger it on a PR that was opened by Dependabot.

Hrishikesh Kadam
  • 35,376
  • 3
  • 26
  • 36
Maxim Krizhanovsky
  • 26,265
  • 5
  • 59
  • 89
  • Here's a link to the section with the conditional check: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#common-dependabot-automations – CTS_AE Sep 26 '22 at 23:48