From 89c533633bdd01349595a88cadaf46d2e7685795 Mon Sep 17 00:00:00 2001 From: sr8384856 Date: Thu, 27 Aug 2026 16:15:43 +1000 Subject: [PATCH] ci(mwpw-00000): skip SonarQube analysis for Dependabot PRs --- .github/workflows/pull-request.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml index 9e5618a53..b5fc3f112 100644 --- a/.github/workflows/pull-request.yaml +++ b/.github/workflows/pull-request.yaml @@ -97,6 +97,10 @@ jobs: sonarqube: name: Run SonarQube Analysis needs: check-coverage-thresholds + # Skip for Dependabot PRs — secrets are withheld by GitHub for Dependabot-triggered + # workflows, so SONAR_HOST_URL resolves empty and the scan fails. A dependency bump + # only touches package.json/package-lock.json, so there is no source to analyse. + if: github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]' runs-on: sonarqube-runners steps: - uses: actions/checkout@v4