Skip to content

fix: skip cloud tests for dependabot when secrets unavailable #28196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Narwhal-fish wants to merge 4 commits into
base: master
Choose a base branch
from
+7 −6
Open

fix: skip cloud tests for dependabot when secrets unavailable #28196

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
088cd31
fix: skip cloud tests for dependabot when secrets unavailable
Narwhal-fish Feb 9, 2026
a572dc6
fix: avoid using github.actor for Dependabot detection
Narwhal-fish Feb 23, 2026
8157c04
fix: restore AWS_SECRET_ACCESS_KEY check for Redshift cloud tests
Narwhal-fish Mar 29, 2026
bc7ad66
fix: refine Dependabot PR detection logic in CI workflow
Narwhal-fish Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ env:
SEGMENT_DOWNLOAD_TIMEOUT_MINS: 5
CI_SKIP_SECRETS_PRESENCE_CHECKS: ${{ secrets.CI_SKIP_SECRETS_PRESENCE_CHECKS }}
SECRETS_PRESENT: ${{ secrets.SECRETS_PRESENT }}
DEPENDABOT_PR: ${{ github.repository == 'trinodb/trino' && github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' }}
PTL_TMP_DOWNLOAD_PATH: /tmp/pt_java_downloads
Comment on lines 33 to 36
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new dependabot gating is only applied to some cloud-test steps. There are still steps that gate execution on repo vars (which Dependabot can read) while consuming secrets (which Dependabot can’t), so dependabot-originated runs can still execute and then fail when secrets are empty. Concrete examples in this workflow: the “Run Hive AWS Tests” step runs when AWS_ACCESS_KEY_ID var is set, and “Cloud Snowflake Tests” runs when SNOWFLAKE_URL var is set. Apply the same DEPENDABOT_PR guard (or check required secrets directly) in those places too so this change fully fixes dependabot builds.

Copilot uses AI. Check for mistakes.

# Cancel previous PR builds.
Expand Down Expand Up @@ -578,7 +579,7 @@ jobs:
AWS_REGION: ${{ vars.TRINO_AWS_REGION }}
if: >-
contains(matrix.modules, 'trino-filesystem-s3') && contains(matrix.profile, 'cloud-tests') &&
(env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || env.AWS_ACCESS_KEY_ID != '' || env.AWS_SECRET_ACCESS_KEY != '')
(env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || (env.AWS_ACCESS_KEY_ID != '' && env.DEPENDABOT_PR != 'true') || env.AWS_SECRET_ACCESS_KEY != '')
run: |
# Create an empty S3 bucket for S3 filesystem cloud tests and add the bucket name to GitHub environment variables
.github/bin/s3/setup-empty-s3-bucket.sh
Expand Down Expand Up @@ -634,7 +635,7 @@ jobs:
# Run tests if any of the secrets is present. Do not skip tests when one secret renamed, or secret name has a typo.
if: >-
contains(matrix.modules, 'trino-delta-lake') && contains(matrix.profile, 'cloud-tests') &&
(env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || env.ABFS_ACCOUNT != '' || env.ABFS_CONTAINER != '' || env.ABFS_ACCESSKEY != '' || env.AWS_ACCESS_KEY_ID != '' || env.AWS_SECRET_ACCESS_KEY != '' || env.GCP_CREDENTIALS_KEY != '')
(env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || ((env.ABFS_ACCOUNT != '' || env.ABFS_CONTAINER != '') && env.DEPENDABOT_PR != 'true') || env.ABFS_ACCESSKEY != '' || (env.AWS_ACCESS_KEY_ID != '' && env.DEPENDABOT_PR != 'true') || env.AWS_SECRET_ACCESS_KEY != '' || env.GCP_CREDENTIALS_KEY != '')
run: |
$MAVEN test ${MAVEN_TEST} ${{ format('-P {0}', matrix.profile) }} -pl :trino-delta-lake \
-Dtesting.azure-abfs-container="${ABFS_CONTAINER}" \
Expand Down Expand Up @@ -715,7 +716,7 @@ jobs:
SNOWFLAKE_CATALOG_S3_REGION: ${{ vars.SNOWFLAKE_CATALOG_S3_REGION }}
if: >-
contains(matrix.modules, 'trino-iceberg') && contains(matrix.profile, 'cloud-tests') &&
(env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || env.AWS_ACCESS_KEY_ID != '' || env.AWS_SECRET_ACCESS_KEY != '' || env.GCP_CREDENTIALS_KEY != '')
(env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || (env.AWS_ACCESS_KEY_ID != '' && env.DEPENDABOT_PR != 'true') || env.AWS_SECRET_ACCESS_KEY != '' || env.GCP_CREDENTIALS_KEY != '')
run: |
$MAVEN test ${MAVEN_TEST} -pl :trino-iceberg ${{ format('-P {0}', matrix.profile) }} \
-Dtesting.gcp-storage-bucket="${GCP_STORAGE_BUCKET}" \
Expand Down Expand Up @@ -748,7 +749,7 @@ jobs:
if: >-
contains(matrix.modules, 'trino-redshift') &&
(contains(matrix.profile, 'cloud-tests') || contains(matrix.profile, 'fte-tests')) &&
(env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || env.AWS_ACCESS_KEY_ID != '' || env.REDSHIFT_SUBNET_GROUP_NAME != '')
(env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' || ((env.AWS_ACCESS_KEY_ID != '' || env.REDSHIFT_SUBNET_GROUP_NAME != '') && env.DEPENDABOT_PR != 'true') || env.AWS_SECRET_ACCESS_KEY != '')
run: |
source .github/bin/redshift/setup-aws-redshift.sh

Expand Down Expand Up @@ -916,8 +917,8 @@ jobs:
- suite: suite-azure
ignore exclusion if: >-
${{ env.CI_SKIP_SECRETS_PRESENCE_CHECKS != '' ||
vars.AZURE_ABFS_HIERARCHICAL_CONTAINER != '' ||
vars.AZURE_ABFS_HIERARCHICAL_ACCOUNT != '' ||
(vars.AZURE_ABFS_HIERARCHICAL_CONTAINER != '' && env.DEPENDABOT_PR != 'true') ||
(vars.AZURE_ABFS_HIERARCHICAL_ACCOUNT != '' && env.DEPENDABOT_PR != 'true') ||
secrets.AZURE_ABFS_HIERARCHICAL_ACCESS_KEY != '' }}

- suite: suite-gcs
Expand Down