fix: skip cloud tests for dependabot when secrets unavailable by Narwhal-fish · Pull Request #28196 · trinodb/trino

Narwhal-fish · 2026-02-09T16:54:54Z

Description

Fixes dependabot-originated builds that fail when cloud tests attempt to run without required secrets.

Dependabot can see repository variables but not secrets (unless specifically configured as dependabot secrets). This causes cloud integration tests to execute when vars.AWS_ACCESS_KEY_ID is present, but then fail when secrets.AWS_SECRET_ACCESS_KEY is missing, resulting in "Unable to load AWS credentials from environment variables" errors.

Fixes #28176

The issue was identified through failed dependabot PR builds where the AWS credentials check passed (because dependabot could see the variable), but the actual test execution failed when attempting to load credentials (because the secret was unavailable).

Release notes

(x) This is not user-visible or is docs only, and no release notes are required.

cla-bot · 2026-02-09T16:54:58Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2026-02-10T05:00:56Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2026-02-12T18:26:51Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2026-02-13T07:30:18Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2026-02-13T07:39:16Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

Copilot

Pull request overview

Adjusts CI workflow gating so Dependabot-originated runs don’t attempt to execute cloud integration tests when required secrets are unavailable, preventing credential-loading failures in GitHub Actions.

Changes:

Updates multiple cloud-test step if: conditions to avoid enabling tests based solely on repo vars when the actor is Dependabot.
Updates PT matrix exclusion override for the Azure suite to avoid enabling it based on vars for Dependabot runs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-02T00:52:09Z

          contains(matrix.modules, 'trino-redshift') &&
          (contains(matrix.profile, 'cloud-tests') || contains(matrix.profile, 'fte-tests')) &&
-          (env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || env.AWS_ACCESS_KEY_ID != '' || env.REDSHIFT_SUBNET_GROUP_NAME != '')
+          (env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || ((env.AWS_ACCESS_KEY_ID != '' || env.REDSHIFT_SUBNET_GROUP_NAME != '') && env.DEPENDABOT_PR != 'true'))


The updated Redshift gating skips the step for dependabot PRs even when the run does have secrets (e.g., a repository_dispatch / “test-with-secrets-command” run). Unlike the other AWS-backed steps, this condition no longer has an explicit “secret present” escape hatch, so dependabot PRs can never run Redshift tests even when AWS_SECRET_ACCESS_KEY is available. Adjust the if: to allow execution when the required secret is present (consistent with the (has-var && !dependabot) || has-secret intent).

Suggested change

(env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || ((env.AWS_ACCESS_KEY_ID != '' || env.REDSHIFT_SUBNET_GROUP_NAME != '') && env.DEPENDABOT_PR != 'true'))

(env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' ||

((env.AWS_ACCESS_KEY_ID != '' || env.REDSHIFT_SUBNET_GROUP_NAME != '') && env.DEPENDABOT_PR != 'true') ||

env.AWS_SECRET_ACCESS_KEY != '')

Copilot · 2026-03-02T00:52:10Z

  CI_SKIP_SECRETS_PRESENCE_CHECKS: ${{ secrets.CI_SKIP_SECRETS_PRESENCE_CHECKS }}
  SECRETS_PRESENT: ${{ secrets.SECRETS_PRESENT }}
+  DEPENDABOT_PR: ${{ github.event.pull_request.user.login == 'dependabot[bot]' || github.event.client_payload.pull_request.user.login == 'dependabot[bot]' }}
  PTL_TMP_DOWNLOAD_PATH: /tmp/pt_java_downloads


The new dependabot gating is only applied to some cloud-test steps. There are still steps that gate execution on repo vars (which Dependabot can read) while consuming secrets (which Dependabot can’t), so dependabot-originated runs can still execute and then fail when secrets are empty. Concrete examples in this workflow: the “Run Hive AWS Tests” step runs when AWS_ACCESS_KEY_ID var is set, and “Cloud Snowflake Tests” runs when SNOWFLAKE_URL var is set. Apply the same DEPENDABOT_PR guard (or check required secrets directly) in those places too so this change fully fixes dependabot builds.

github-actions · 2026-03-23T17:18:28Z

This pull request has gone a while without any activity. Ask for help on #core-dev on Trino slack.

chenjian2664 · 2026-03-24T10:11:12Z

@coderabbitai full review

coderabbitai · 2026-03-24T10:11:19Z

✅ Actions performed

Full review triggered.

coderabbitai · 2026-03-24T10:19:12Z

📝 Walkthrough

Walkthrough

The PR introduces detection for Dependabot-initiated builds by adding a workflow-level DEPENDABOT_PR environment variable that checks if the pull request author is dependabot[bot]. It then updates conditional gating across multiple cloud-related test steps (HDFS, S3, Delta Lake, Iceberg, and Redshift) to prevent these jobs from running on Dependabot PRs when only repository variables are available without corresponding secrets.

Assessment against linked issues

Objective	Addressed	Explanation
Prevent dependabot-originated builds from failing due to lack of secrets (`#28176`)	✅

Out-of-scope changes

Code Change	Explanation
Added `CI_SKIP_SECRETS_PRESENCE_CHECKS` environment variable check in job conditions	This allows bypassing the Dependabot PR check entirely, which was not mentioned in the proposed solution in `#28176` that specified only `(has-var && !dependabot-originated) \|\| has-secret`. The skip flag adds an additional override mechanism beyond what was requested.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 771-774: The conditional gating the trino-redshift cloud tests
dropped the AWS secret check and therefore skips Redshift when only
REDSHIFT_AWS_SECRET_ACCESS_KEY is provided (e.g., Dependabot). Update the if
expression that checks matrix.modules == 'trino-redshift' / matrix.profile ==
'cloud-tests'||'fte-tests' to include env.AWS_SECRET_ACCESS_KEY != '' as an
alternative alongside env.AWS_ACCESS_KEY_ID != '' and
env.REDSHIFT_SUBNET_GROUP_NAME != '', preserving the existing
env.CI_SKIP_SECRETS_PRESENCE_CHECKS and env.DEPENDABOT_PR logic so
secrets-provided runs (including Dependabot via secrets) will not be incorrectly
skipped.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 20729cfa-1de3-4205-9ec9-8d40e541feb4

📥 Commits

Reviewing files that changed from the base of the PR and between 8dec32f and 6bb4b69.

📒 Files selected for processing (1)

.github/workflows/ci.yml

coderabbitai · 2026-03-24T10:19:15Z

        if: >-
          contains(matrix.modules, 'trino-redshift') &&
          (contains(matrix.profile, 'cloud-tests') || contains(matrix.profile, 'fte-tests')) &&
-          (env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || env.AWS_ACCESS_KEY_ID != '' || env.REDSHIFT_SUBNET_GROUP_NAME != '')
+          (env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || ((env.AWS_ACCESS_KEY_ID != '' || env.REDSHIFT_SUBNET_GROUP_NAME != '') && env.DEPENDABOT_PR != 'true'))


⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, let's read the workflow file around lines 771-774 wc -l .github/workflows/ci.yml

Repository: trinodb/trino

Length of output: 1864

🏁 Script executed:

# Read the specific section in question sed -n '765,780p' .github/workflows/ci.yml

Repository: trinodb/trino

Length of output: 1145

🏁 Script executed:

# Search for other similar Redshift or cloud-test conditions to compare patterns rg -n "trino-redshift" .github/workflows/ci.yml -A 5 -B 2

Repository: trinodb/trino

Length of output: 2454

🏁 Script executed:

# Also search for AWS_SECRET_ACCESS_KEY checks in the workflow rg -n "AWS_SECRET_ACCESS_KEY" .github/workflows/ci.yml -B 2 -A 2

Repository: trinodb/trino

Length of output: 5090

Restore the Redshift secret-backed path.

This is the only updated guard that drops env.AWS_SECRET_ACCESS_KEY != ''. All comparable cloud-test gates (hdfs, s3, delta-lake, iceberg) include this check as an alternative. A Dependabot-triggered run with REDSHIFT_AWS_SECRET_ACCESS_KEY configured will still skip Redshift, even though Dependabot secrets are exposed through the secrets context and the step explicitly defines and uses this secret.

Suggested fix

- (env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || ((env.AWS_ACCESS_KEY_ID != '' || env.REDSHIFT_SUBNET_GROUP_NAME != '') && env.DEPENDABOT_PR != 'true')) + (env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || + ((env.AWS_ACCESS_KEY_ID != '' || env.REDSHIFT_SUBNET_GROUP_NAME != '') && env.DEPENDABOT_PR != 'true') || + env.AWS_SECRET_ACCESS_KEY != '')

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci.yml around lines 771 - 774, The conditional gating the trino-redshift cloud tests dropped the AWS secret check and therefore skips Redshift when only REDSHIFT_AWS_SECRET_ACCESS_KEY is provided (e.g., Dependabot). Update the if expression that checks matrix.modules == 'trino-redshift' / matrix.profile == 'cloud-tests'||'fte-tests' to include env.AWS_SECRET_ACCESS_KEY != '' as an alternative alongside env.AWS_ACCESS_KEY_ID != '' and env.REDSHIFT_SUBNET_GROUP_NAME != '', preserving the existing env.CI_SKIP_SECRETS_PRESENCE_CHECKS and env.DEPENDABOT_PR logic so secrets-provided runs (including Dependabot via secrets) will not be incorrectly skipped.

✅ Confirmed as addressed by @Narwhal-fish

OK I'll add the AWS_SECRET_ACCESS_KEY check back.

@Narwhal-fish, sounds good! Just to confirm, the updated condition should look like:

(env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || ((env.AWS_ACCESS_KEY_ID != '' || env.REDSHIFT_SUBNET_GROUP_NAME != '') && env.DEPENDABOT_PR != 'true') || env.AWS_SECRET_ACCESS_KEY != '')

This ensures that Redshift cloud tests can still run when REDSHIFT_AWS_SECRET_ACCESS_KEY is explicitly configured for Dependabot, while also blocking runs where only the variable-backed path (AWS_ACCESS_KEY_ID or REDSHIFT_SUBNET_GROUP_NAME) is visible without the secret.

findepi · 2026-03-30T07:12:49Z

  SEGMENT_DOWNLOAD_TIMEOUT_MINS: 5
  CI_SKIP_SECRETS_PRESENCE_CHECKS: ${{ secrets.CI_SKIP_SECRETS_PRESENCE_CHECKS }}
  SECRETS_PRESENT: ${{ secrets.SECRETS_PRESENT }}
+  DEPENDABOT_PR: ${{ github.event.pull_request.user.login == 'dependabot[bot]' || github.event.client_payload.pull_request.user.login == 'dependabot[bot]' }}


Why have condition on github.event.client_payload.pull_request.user.login? Github docs suggest checking github.event.pull_request.user.login (https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/automating-dependabot-with-github-actions#automatically-approving-a-pull-request)
Add condition on github.repository. This shouldn't have effect in forks (also as suggested by github docs).

The original reason I used github.event.client_payload.pull_request.user.login was also to support repository_dispatch runs.. I wiil updated it later.

Allow Redshift tests to run when only AWS_SECRET_ACCESS_KEY is available (e.g., when configured as a Dependabot secret), matching the pattern used by other cloud-test gates (HDFS, S3, Delta Lake, Iceberg).

github-actions · 2026-04-27T17:31:01Z

This pull request has gone a while without any activity. Ask for help on #core-dev on Trino slack.

Narwhal-fish force-pushed the dependabot-originating-builds-fail-due-to-lack-of-secrets branch from ef3d04f to 945c24f Compare February 12, 2026 18:26

Narwhal-fish force-pushed the dependabot-originating-builds-fail-due-to-lack-of-secrets branch from 76fd8cc to 945c24f Compare February 13, 2026 07:39

Narwhal-fish changed the title ~~[WIP] fix: skip cloud tests for dependabot when secrets unavailable~~ fix: skip cloud tests for dependabot when secrets unavailable Feb 14, 2026

Narwhal-fish marked this pull request as ready for review February 14, 2026 14:40

cla-bot Bot added the cla-signed label Feb 22, 2026

Narwhal-fish force-pushed the dependabot-originating-builds-fail-due-to-lack-of-secrets branch 3 times, most recently from e548b80 to 53964d8 Compare February 23, 2026 13:54

Narwhal-fish requested a review from Copilot February 23, 2026 14:00

Copilot started reviewing on behalf of Narwhal-fish February 23, 2026 14:00 View session

Copilot AI reviewed Feb 23, 2026

View reviewed changes

Comment thread .github/workflows/ci.yml Outdated

Comment thread .github/workflows/ci.yml Outdated

Comment thread .github/workflows/ci.yml Outdated

Comment thread .github/workflows/ci.yml Outdated

Comment thread .github/workflows/ci.yml Outdated

Comment thread .github/workflows/ci.yml Outdated

Narwhal-fish force-pushed the dependabot-originating-builds-fail-due-to-lack-of-secrets branch 2 times, most recently from 945c24f to 809ac23 Compare February 23, 2026 15:08

Narwhal-fish marked this pull request as draft February 23, 2026 15:10

Narwhal-fish marked this pull request as ready for review February 23, 2026 15:43

Narwhal-fish requested a review from findepi February 23, 2026 16:51

findepi requested review from ebyhr and wendigo February 25, 2026 02:25

ebyhr requested a review from Copilot March 2, 2026 00:48

Copilot started reviewing on behalf of ebyhr March 2, 2026 00:49 View session

Copilot AI reviewed Mar 2, 2026

View reviewed changes

wendigo requested a review from chenjian2664 March 2, 2026 11:48

github-actions Bot added the stale label Mar 23, 2026

coderabbitai Bot reviewed Mar 24, 2026

View reviewed changes

github-actions Bot removed the stale label Mar 24, 2026

Narwhal-fish force-pushed the dependabot-originating-builds-fail-due-to-lack-of-secrets branch from 51d99cc to e842171 Compare March 29, 2026 15:50

findepi reviewed Mar 30, 2026

View reviewed changes

Narwhal-fish force-pushed the dependabot-originating-builds-fail-due-to-lack-of-secrets branch 4 times, most recently from 8d18519 to 8b6032a Compare April 6, 2026 08:46

Narwhal-fish added 4 commits April 6, 2026 16:51

fix: skip cloud tests for dependabot when secrets unavailable

088cd31

fix: avoid using github.actor for Dependabot detection

a572dc6

fix: restore AWS_SECRET_ACCESS_KEY check for Redshift cloud tests

8157c04

Allow Redshift tests to run when only AWS_SECRET_ACCESS_KEY is available (e.g., when configured as a Dependabot secret), matching the pattern used by other cloud-test gates (HDFS, S3, Delta Lake, Iceberg).

fix: refine Dependabot PR detection logic in CI workflow

bc7ad66

Narwhal-fish force-pushed the dependabot-originating-builds-fail-due-to-lack-of-secrets branch from 8b6032a to bc7ad66 Compare April 6, 2026 08:52

github-actions Bot added the stale label Apr 27, 2026

github-actions Bot removed the stale label May 12, 2026

Conversation

Narwhal-fish commented Feb 9, 2026 • edited by ebyhr Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Release notes

Uh oh!

cla-bot Bot commented Feb 9, 2026

Uh oh!

cla-bot Bot commented Feb 10, 2026

Uh oh!

cla-bot Bot commented Feb 12, 2026

Uh oh!

cla-bot Bot commented Feb 13, 2026

Uh oh!

cla-bot Bot commented Feb 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Mar 23, 2026

Uh oh!

chenjian2664 commented Mar 24, 2026

Uh oh!

coderabbitai Bot commented Mar 24, 2026

Uh oh!

coderabbitai Bot commented Mar 24, 2026

Walkthrough

Assessment against linked issues

Out-of-scope changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Narwhal-fish Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

findepi Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Narwhal-fish Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

Narwhal-fish commented Feb 9, 2026 •

edited by ebyhr

Loading

coderabbitai Bot Mar 24, 2026 •

edited

Loading

Narwhal-fish Mar 30, 2026 •

edited

Loading